CVE-2026-88592
UnknownSummary
kkFileView 4.2.0 and later is vulnerable to Server-Side Request Forgery in the /getCorsFile endpoint. The TrustHostFilter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath, allowing bypass of the trust.host whitelist by supplying both urlPath (real target) and url (whitelisted decoy), with the response body echoed back to the attacker.
Risk Assessment
An attacker can force the server to request arbitrary internal resources and read their responses, leading to data leakage and potential pivoting into the internal network. The risk is high because the attack requires no authentication.
Recommendation
Upgrade kkFileView to a version where the filter and controller validate the same parameter, or apply a fix that eliminates the validation mismatch. Restrict the server's access to internal networks and metadata services.
Other vulnerabilities in kkFileView
See all- CVE-2026-88593Unknown
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.
- CVE-2026-73244Medium
kkFileView prior to 5.0.1 has an unauthenticated POST /listFiles endpoint that passes the user-controlled path parameter to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root.
- CVE-2026-73243Medium
kkFileView prior to 5.0.1 has an unauthenticated GET /addTask endpoint that is omitted from TrustHostFilter and TrustDirFilter, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type.
Original NVD description (English source)
kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: the filter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath. By supplying both urlPath=<real target> and url=<whitelisted decoy address> in the same request, the decoy passes validation while the unvalidated real target is fetched server-side — and the response body is echoed back to the attacker.