CVE-2026-73244
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
kkFileView prior to 5.0.1 has an unauthenticated POST /listFiles endpoint that passes the user-controlled path parameter to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root.
Risk Assessment
The risk includes disclosure of directory structure and potentially sensitive files on the system running kkFileView.
Recommendation
Upgrade kkFileView to version 5.0.1 or later, which includes a fix.
Original NVD description (English source)
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.