WS-2022-0259

An unauthenticated Path Traversal was found in kareadita/kavita. An unauthenticated user can read and download files of the application system by abusing the filename parameter, of the /api/image/cover-upload endpoint, that is not properly sanitized. This allows an attacker to read many files,...