kkFileView CVE-2026-124556

Exploitation requires the attacker to supply a crafted X-Base-Url HTTP header that BaseUrlFilter.getBaseUrl uses to build a redirect/base URL, and a victim must then follow the attacker-supplied link (UI:P, passive user interaction) for the redirect to take effect. No authentication is required (PR:N) and the flaw is reachable remotely over the network against affected kkFileView builds up to 5.0.3. The main limiting factors are the mandatory user interaction and the impact ceiling: this only redirects a user to an attacker-chosen destination (integrity-low), yielding no direct code execution, data disclosure, or service disruption, which bounds realistic risk to phishing and social-engineering chains.

This is a moderate-severity open redirect (CWE-601) whose signals are self-consistent and point to a low-to-moderate real-world priority rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) describes a remotely reachable, unauthenticated flaw with no attack requirements but mandatory passive user interaction and only low integrity impact and no confidentiality or availability impact - fully consistent with an open redirect used for phishing rather than code execution or data theft. VulDB assigns a 'this_month' decision label and exploit maturity E:P (proof-of-concept), and the description states the exploit has been publicly disclosed, so a public PoC reference exists; it is not verified as working exploit code. The vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - this is a disclosed-with-PoC issue, not confirmed in-the-wild abuse. Net: a genuine but contained risk whose impact is limited to redirecting users to attacker-controlled destinations; treat as routine remediation aligned with the vendor's own GHSA advisory, not as an urgent incident.

An attacker crafts a request to a kkFileView instance supplying an attacker-controlled X-Base-Url header, which BaseUrlFilter.getBaseUrl trusts and reflects into a generated redirect/base URL. A victim who follows the attacker's link (UI:P) is then transparently redirected from the trusted kkFileView host to an attacker-controlled site, enabling phishing or credential harvesting. A public PoC reference exists (exploit maturity Proof-of-Concept); it is not verified as working exploit code.