What is the CVSS score of EUVD-2026-56940?

EUVD-2026-56940 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-56940?

Yes, a patch is available for EUVD-2026-56940. Update the affected software to the latest version immediately.

kkFileView EUVD-2026-56940

| CVE-2026-73244 MEDIUM

Path Traversal (CWE-22)

2026-08-11 security-advisories@github.com

Path Traversal Java

5.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint requires no privileges or interaction; read-only directory listing yields only low confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 11, 2026 - 23:25 vuln.today

Analysis Generated

Aug 11, 2026 - 23:25 vuln.today

Patch available

Aug 11, 2026 - 21:18 EUVD

DescriptionCVE.org

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.

AnalysisAI

Directory traversal in kkFileView prior to 5.0.1 exposes an unauthenticated POST /listFiles endpoint that accepts a user-supplied path parameter and passes it directly to Files.newDirectoryStream without confining it to the configured demo directory, enabling remote attackers to enumerate arbitrary server-side directories. The flaw is mechanically straightforward - no credentials, no user interaction, and no special configuration are required - though impact is bounded to directory listing rather than file content disclosure. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify internet-exposed kkFileView instance

Delivery

Send POST /listFiles with traversal path (e.g., ../../etc)

Exploit

Receive JSON directory listing outside demo root

Execution

Enumerate sensitive directories (config, logs, home)

Impact

Use filesystem intelligence to plan follow-on attack

Access

Identify internet-exposed kkFileView instance

Delivery

Send POST /listFiles with traversal path (e.g., ../../etc)

Exploit

Receive JSON directory listing outside demo root

Execution

Enumerate sensitive directories (config, logs, home)

Impact

Use filesystem intelligence to plan follow-on attack

Vulnerability AssessmentAI

Exploitation	No authentication is required - the /listFiles endpoint is explicitly described as unauthenticated, consistent with CVSS PR:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the bounded nature of the vulnerability: the disclosed information is limited to directory names, not file contents, and there is no write or denial-of-service primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a POST request to the target's /listFiles endpoint with a path parameter such as ../../etc or ../../home/appuser; the server resolves this against the demo directory base path and calls Files.newDirectoryStream on the traversed location, returning a JSON directory listing. No public POC has been identified, but the vulnerability is mechanically trivial and the exact injection point is documented in the public fix commit, making independent reproduction straightforward for any attacker who reads the patch.
Remediation	Upgrade kkFileView to version 5.0.1 or later; this is the vendor-confirmed fix, delivered via GitHub release tag v5.0.1 (https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1) and commit 47745e4d (https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae). … Detailed patch versions, workarounds, and compensating controls in full report.