kkFileView CVE-2026-95140

Exploitation requires network reachability to a kkFileView 5.0.0-5.0.2 instance and that the file-management endpoints (fileUpload, createFolder, existsFile) are exposed; the attacker supplies a 'path' request parameter that is concatenated into the upload base path without validation. No authentication and no user interaction are required (PR:N/UI:N), and default configurations are affected where these endpoints are reachable. The principal limiting factor is exposure rather than configuration: kkFileView is commonly deployed as an internal/back-office preview service, so internet-facing, unauthenticated reachability of the upload endpoints is the real-world precondition that gates mass exploitation.

Signals are mixed. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with high integrity impact and no confidentiality or availability impact - consistent with arbitrary file/directory write. No EPSS score, no CISA KEV listing, and no confirmed public exploit code (POC) were provided in the input, so exploitation status is: no public exploit identified at time of analysis - although a public GitHub disclosure issue (sg-summer/cve/issues/4) exists. No SSVC decision data was supplied. The technical impact is serious: an unauthenticated attacker who can write files outside fileDir can typically escalate a CWE-22 path traversal to remote code execution by planting a webshell in a web-served directory, which in practice means the I:H rating understates real-world consequence (confidentiality/availability would follow a successful RCE even though the base vector marks them N). The key moderating factor is exposure: kkFileView is usually deployed as an internal document-preview microservice rather than an internet-facing application, and the vulnerable upload endpoints may not be enabled or reachable in every deployment. Net assessment: a genuine high-priority issue for any organization exposing kkFileView 5.0.0-5.0.2, but likely limited in blast radius due to the product's niche, often-internal deployment pattern rather than any lack of technical severity.

An unauthenticated attacker locates a reachable kkFileView 5.0.0-5.0.2 instance and sends a crafted multipart upload request to the fileUpload endpoint with a 'path' parameter containing directory-traversal sequences (e.g. ../../), causing a file to be written outside the intended fileDir root - for example a JSP/webshell into a web-served directory - which is then requested to obtain code execution. A public disclosure issue exists on GitHub, but no confirmed weaponized exploit code was provided in the input data.