kkFileView EUVD-2026-81259

No special conditions beyond the product being deployed with the default cross-origin file proxy: exploitation is remote and unauthenticated (PR:N/UI:N) against any kkFileView >= 4.2.0 exposing /getCorsFile. The specific prerequisite is that the request carry two parameters - a whitelisted 'url' (or higher-priority) value that satisfies the trust.host check, plus the real 'urlPath' target the controller actually fetches - exploiting the mismatch between the parameter TrustHostFilter validates and the one the controller reads. Limiting factors are minimal: the attacker must reach the endpoint over the network and must know a value that passes the trust.host whitelist (the decoy), which the filter's fixed priority ordering makes straightforward; there is no auth, MFA, or user-interaction barrier.

This is a genuine high-priority network-exploitable flaw, though the vendor CVSS of 9.1 is somewhat inflated. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is credible: exploitation requires only a single crafted HTTP request to the /getCorsFile endpoint with no authentication and no user interaction, and the described bypass is deterministic (no race, no brute force), justifying AC:L. My disagreement is with the impact metrics: this is a classic response-echoing SSRF whose realistic effect is reading server-side/internal resources (C:H), not modifying them - I:H is not supported by the described behavior, so my independent score is ~7.5. On the exploitation-probability side, there is no CISA KEV listing, no EPSS score in the input, and no confirmed weaponized proof-of-concept; the sole technical reference (github.com/sg-summer/cve/issues/2) is a researcher write-up that documents the parameter-confusion mechanism in enough detail to serve as a near-recipe, but it is not a packaged exploit. Net: real and easy to trigger, but currently 'no public exploit identified' rather than actively exploited - treat as a fast-patch item on internet-facing kkFileView instances rather than an emergency. Note the CPE (cpe:2.3:a:n/a:...) is a placeholder and does not encode the affected product, so version scoping relies on the description ('>= 4.2.0') alone.

An unauthenticated attacker sends a single request to /getCorsFile supplying both url=<a whitelisted trust.host address> and urlPath=http://169.254.169.254/latest/meta-data/ (or an internal service URL). The TrustHostFilter validates the decoy 'url' parameter and lets the request through, but the controller fetches the attacker-controlled 'urlPath' and echoes the response body back, disclosing internal/cloud-metadata content. No public weaponized exploit is identified, but the referenced write-up details the exact parameter-confusion bypass.