CVE-2026-95140
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
kkFileView versions 5.0.0 through 5.0.2 contain a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request.
Risk Assessment
An attacker can write files outside the intended directory, potentially leading to overwriting critical files, placing malicious code, or compromising system integrity.
Recommendation
Upgrade kkFileView to a patched version. Additionally, validate the "path" parameter in endpoints to prevent directory traversal.
Other vulnerabilities in kkFileView
See all- CVE-2026-88592Critical
kkFileView 4.2.0 and later is vulnerable to Server-Side Request Forgery in the /getCorsFile endpoint. The TrustHostFilter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath, allowing bypass of the trust.host whitelist by supplying both urlPath (real target) and url (whitelisted decoy), with the response body echoed back to the attacker.
- CVE-2026-88593Medium
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.
- CVE-2026-73244Medium
kkFileView prior to 5.0.1 has an unauthenticated POST /listFiles endpoint that passes the user-controlled path parameter to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root.
- CVE-2026-73243Medium
kkFileView prior to 5.0.1 has an unauthenticated GET /addTask endpoint that is omitted from TrustHostFilter and TrustDirFilter, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type.
Original NVD description (English source)
kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request
Vulnerability data from NVD (NIST) · CISA KEV · EPSS