Refine your search

2 vulnerabilities found for kkFileView by kekingcn

CVE-2026-73244 (GCVE-0-2026-73244)
Vulnerability from cvelistv5
Published
2026-08-11 20:08
Modified
2026-08-13 13:55
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.
References
Impacted products
Vendor Product Version
kekingcn kkFileView Version: < 5.0.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73244",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T13:55:34.539330Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T13:55:43.147Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kkFileView",
          "vendor": "kekingcn",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:08:25.054Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq"
        },
        {
          "name": "https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae"
        },
        {
          "name": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-pmp8-g8p2-p6jq",
        "discovery": "UNKNOWN"
      },
      "title": "kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73244",
    "datePublished": "2026-08-11T20:08:25.054Z",
    "dateReserved": "2026-08-11T17:18:01.597Z",
    "dateUpdated": "2026-08-13T13:55:43.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73243 (GCVE-0-2026-73243)
Vulnerability from cvelistv5
Published
2026-08-11 20:04
Modified
2026-08-11 20:14
Severity ?
5.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Summary
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.
References
Impacted products
Vendor Product Version
kekingcn kkFileView Version: < 5.0.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73243",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T20:14:19.920749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T20:14:46.519Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kkFileView",
          "vendor": "kekingcn",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:04:38.710Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m"
        },
        {
          "name": "https://github.com/kekingcn/kkFileView/issues/765",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kekingcn/kkFileView/issues/765"
        },
        {
          "name": "https://github.com/kekingcn/kkFileView/pull/767",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kekingcn/kkFileView/pull/767"
        },
        {
          "name": "https://github.com/kekingcn/kkFileView/commit/32a887aa2cd70228998c617c4e7df6cfcf3fe709",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kekingcn/kkFileView/commit/32a887aa2cd70228998c617c4e7df6cfcf3fe709"
        },
        {
          "name": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-gwwj-52hv-6g2m",
        "discovery": "UNKNOWN"
      },
      "title": "kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73243",
    "datePublished": "2026-08-11T20:04:38.710Z",
    "dateReserved": "2026-08-11T17:18:01.597Z",
    "dateUpdated": "2026-08-11T20:14:46.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}