kkFileView CVE-2026-73243

No special conditions are required beyond a network-accessible kkFileView instance running a version prior to 5.0.1 - the /addTask endpoint is unauthenticated and the filter bypass exists in the default configuration. The attacker must craft the fullfilename parameter such that FileHandlerService#getFileAttribute classifies it as an OFFICE, COMPRESS, or CAD file type (achievable by controlling the file extension), which causes FileConvertQueueTask to initiate an outbound fetch to the attacker-supplied URL. Exploitation is limited in impact by what internal hosts and services are reachable from the kkFileView server's network position; without further vulnerabilities on reachable internal services, the attacker cannot achieve code execution or data modification through this SSRF alone. The vulnerability does not require user interaction, elevated privileges, or any non-default configuration of kkFileView.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N yields a 5.8 score, which reflects a network-exploitable, zero-authentication SSRF with Scope:Changed - indicating the server-side fetch can reach systems beyond the vulnerable application itself, such as internal APIs, cloud metadata endpoints, or RFC 1918 network resources. SSVC rates this as automatable with partial technical impact and confirms a POC exists, significantly lowering the operational bar for exploitation. However, direct impact is bounded to confidentiality at a low level (C:L) - the attacker cannot write files, execute code, or cause availability loss via this vector alone. The SSRF is most dangerous when kkFileView is deployed in an environment with rich internal network access (e.g., adjacent to internal APIs, cloud IMDS endpoints like 169.254.169.254, or other internal services). There is no CISA KEV listing at time of analysis, which is consistent with targeted rather than widespread exploitation. The moderate CVSS score may understate real-world risk for cloud-hosted or internally-networked deployments where SSRF can pivot to high-value resources. No conflicting signals exist between CVSS and description; the scope-changed rating is well-supported by the filter-bypass mechanism.

An unauthenticated attacker sends a GET request to /addTask with a fullfilename parameter ending in a crafted extension (e.g., .docx or .zip) pointing to an internal URL such as http://192.168.1.1/admin/api or the cloud IMDS endpoint http://169.254.169.254/latest/meta-data/. Because /addTask bypasses both TrustHostFilter and TrustDirFilter, the server's FileConvertQueueTask issues an outbound HTTP fetch to the attacker-controlled URL and processes the response, potentially exposing internal network topology, service banners, or cloud credentials. A POC is available per SSVC intelligence, and the attack is automatable, enabling scripted scanning of internal address space.