kkFileView EUVD-2026-56940

No authentication is required - the /listFiles endpoint is explicitly described as unauthenticated, consistent with CVSS PR:N. Exploitation requires only network access to the kkFileView HTTP service and the ability to send a POST request with a crafted path parameter; no special privileges, session tokens, or non-default configuration are needed. Exploitation is constrained to directory enumeration only - file contents cannot be retrieved through this endpoint. The filesystem paths reachable are limited to those accessible under the OS user account running the kkFileView process. If the service is deployed exclusively on an internal network with no external exposure, exploitation is limited to actors who already have internal network access.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the bounded nature of the vulnerability: the disclosed information is limited to directory names, not file contents, and there is no write or denial-of-service primitive. The unauthenticated network vector with low attack complexity is the most operationally significant signal - exploitation requires nothing beyond a crafted HTTP POST request. EPSS data was not provided in the available intelligence, so relative exploitation probability cannot be independently quantified. The absence of a CISA KEV entry and the absence of confirmed public POC code suggest opportunistic mass exploitation is not currently observed, though the simplicity of the attack makes it accessible to low-sophistication actors. The primary residual risk is that directory listings frequently expose paths to configuration files, credential stores, and log directories that facilitate reconnaissance for higher-impact follow-on attacks, amplifying the effective impact beyond the raw CVSS score implies.

An unauthenticated attacker sends a POST request to the target's /listFiles endpoint with a path parameter such as ../../etc or ../../home/appuser; the server resolves this against the demo directory base path and calls Files.newDirectoryStream on the traversed location, returning a JSON directory listing. No public POC has been identified, but the vulnerability is mechanically trivial and the exact injection point is documented in the public fix commit, making independent reproduction straightforward for any attacker who reads the patch.