CVE-2026-88593
UnknownSummary
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.
Risk Assessment
An attacker can execute arbitrary script in the victim's browser, potentially leading to session or data theft. Organizations exposing kkFileView to users are at risk.
Recommendation
Upgrade kkFileView to a version later than 5.0.2 that contains the fix. Until then, consider validating and sanitizing the page and kkagent parameters on the server side.
Other vulnerabilities in kkFileView
See all- CVE-2026-88592Unknown
kkFileView 4.2.0 and later is vulnerable to Server-Side Request Forgery in the /getCorsFile endpoint. The TrustHostFilter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath, allowing bypass of the trust.host whitelist by supplying both urlPath (real target) and url (whitelisted decoy), with the response body echoed back to the attacker.
- CVE-2026-73244Medium
kkFileView prior to 5.0.1 has an unauthenticated POST /listFiles endpoint that passes the user-controlled path parameter to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root.
- CVE-2026-73243Medium
kkFileView prior to 5.0.1 has an unauthenticated GET /addTask endpoint that is omitted from TrustHostFilter and TrustDirFilter, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type.
Original NVD description (English source)
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.