Search
Find a vulnerability
Search criteria
3 vulnerabilities by kekingcn
CVE-2026-124556 (GCVE-0-2026-124556)
Vulnerability from cvelistv5 – Published: 2026-11-09 02:15 – Updated: 2026-11-09 02:15
VLAI
EPSS
VEX
Title
kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect
Summary
A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-601 - Open Redirect
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432888 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432888/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124556 | third-party-advisory |
| https://vuldb.com/submit/1035489 | third-party-advisory |
| https://github.com/kekingcn/kkFileView/security/a… | broken-link |
| https://github.com/kekingcn/kkFileView/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kekingcn | kkFileView |
Affected:
5.0.0
Affected: 5.0.1 Affected: 5.0.2 Affected: 5.0.3 cpe:2.3:a:kekingcn:kkfileview:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kekingcn:kkfileview:*:*:*:*:*:*:*:*"
],
"product": "kkFileView",
"vendor": "kekingcn",
"versions": [
{
"status": "affected",
"version": "5.0.0"
},
{
"status": "affected",
"version": "5.0.1"
},
{
"status": "affected",
"version": "5.0.2"
},
{
"status": "affected",
"version": "5.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lucasg2g (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T02:15:25.557Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432888 | kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432888"
},
{
"name": "VDB-432888 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432888/cti"
},
{
"name": "CVE-2026-124556 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124556"
},
{
"name": "Submit #1035489 | kekingcn kkFileView v5.0.2 (reviewed release commit `c4288f7e`, official-baseline jar `server/target/kkFileView-5.0.2.jar`); the `X-Base-Url` header precedence has been in place since 2021 and the same filter pair is still present on upstream `main` URL r",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035489"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-wrm9-r4fj-f8q5"
},
{
"tags": [
"product"
],
"url": "https://github.com/kekingcn/kkFileView/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T15:18:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124556",
"datePublished": "2026-11-09T02:15:25.557Z",
"dateReserved": "2026-11-08T14:13:51.633Z",
"dateUpdated": "2026-11-09T02:15:25.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73244 (GCVE-0-2026-73244)
Vulnerability from cvelistv5 – Published: 2026-08-11 20:08 – Updated: 2026-08-13 13:55
VLAI
EPSS
VEX
Title
kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing
Summary
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:55 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kekingcn/kkFileView/security/a… | x_refsource_CONFIRM |
| https://github.com/kekingcn/kkFileView/commit/477… | x_refsource_MISC |
| https://github.com/kekingcn/kkFileView/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kekingcn | kkFileView |
Affected:
< 5.0.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73244",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:55:34.539330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:55:43.147Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kkFileView",
"vendor": "kekingcn",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T20:08:25.054Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq"
},
{
"name": "https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae"
},
{
"name": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1"
}
],
"source": {
"advisory": "GHSA-pmp8-g8p2-p6jq",
"discovery": "UNKNOWN"
},
"title": "kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73244",
"datePublished": "2026-08-11T20:08:25.054Z",
"dateReserved": "2026-08-11T17:18:01.597Z",
"dateUpdated": "2026-08-13T13:55:43.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73243 (GCVE-0-2026-73243)
Vulnerability from cvelistv5 – Published: 2026-08-11 20:04 – Updated: 2026-08-11 20:14
VLAI
EPSS
VEX
Title
kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass
Summary
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.
Severity
5.8 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 20:14 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/kekingcn/kkFileView/security/a… | x_refsource_CONFIRM |
| https://github.com/kekingcn/kkFileView/issues/765 | x_refsource_MISC |
| https://github.com/kekingcn/kkFileView/pull/767 | x_refsource_MISC |
| https://github.com/kekingcn/kkFileView/commit/32a… | x_refsource_MISC |
| https://github.com/kekingcn/kkFileView/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kekingcn | kkFileView |
Affected:
< 5.0.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73243",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T20:14:19.920749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T20:14:46.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kkFileView",
"vendor": "kekingcn",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T20:04:38.710Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m"
},
{
"name": "https://github.com/kekingcn/kkFileView/issues/765",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kekingcn/kkFileView/issues/765"
},
{
"name": "https://github.com/kekingcn/kkFileView/pull/767",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kekingcn/kkFileView/pull/767"
},
{
"name": "https://github.com/kekingcn/kkFileView/commit/32a887aa2cd70228998c617c4e7df6cfcf3fe709",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kekingcn/kkFileView/commit/32a887aa2cd70228998c617c4e7df6cfcf3fe709"
},
{
"name": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1"
}
],
"source": {
"advisory": "GHSA-gwwj-52hv-6g2m",
"discovery": "UNKNOWN"
},
"title": "kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73243",
"datePublished": "2026-08-11T20:04:38.710Z",
"dateReserved": "2026-08-11T17:18:01.597Z",
"dateUpdated": "2026-08-11T20:14:46.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}