CVE-2026-88592

{"id": "CVE-2026-88592", "cveTags": [], "metrics": {}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-09-16T20:17:38.453", "references": [{"url": "https://github.com/sg-summer/cve/issues/2", "source": "cve@mitre.org"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: the filter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath. By supplying both urlPath=<real target> and url=<whitelisted decoy address> in the same request, the decoy passes validation while the unvalidated real target is fetched server-side \u2014 and the response body is echoed back to the attacker."}], "lastModified": "2026-09-16T20:17:38.453", "sourceIdentifier": "cve@mitre.org"}