CVE-2026-73244

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae
https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1
https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq
https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) kkFileView es un proyecto universal de vista previa de archivos en línea basado en Spring Boot. Antes de la versión 5.0.1, el endpoint POST /listFiles no autenticado en servidor/src/main/java/cn/keking/web/controller/FileController.java pasa el parámetro de ruta controlado por el usuario de FileController#getFiles a Files.newDirectoryStream sin confinamiento al directorio demo, permitiendo la enumeración de directorios fuera de la raíz prevista. Este problema está solucionado en la versión 5.0.1.

Information

Published : 2026-08-11 20:18

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73244

Mitre link : CVE-2026-73244

CVE.ORG link : CVE-2026-73244

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-73244", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73244", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:55:34.539330Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kekingcn", "product": "kkFileView", "versions": [{"status": "affected", "version": "< 5.0.1"}]}]}], "published": "2026-08-11T20:18:49.547", "references": [{"url": "https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae", "source": "security-advisories@github.com"}, {"url": "https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq", "source": "security-advisories@github.com"}, {"url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1."}, {"lang": "es", "value": "kkFileView es un proyecto universal de vista previa de archivos en l\u00ednea basado en Spring Boot. Antes de la versi\u00f3n 5.0.1, el endpoint POST /listFiles no autenticado en servidor/src/main/java/cn/keking/web/controller/FileController.java pasa el par\u00e1metro de ruta controlado por el usuario de FileController#getFiles a Files.newDirectoryStream sin confinamiento al directorio demo, permitiendo la enumeraci\u00f3n de directorios fuera de la ra\u00edz prevista. Este problema est\u00e1 solucionado en la versi\u00f3n 5.0.1."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}