Kkfileview

CVE-2026-95140 Oct 06, 00:00 HIGH This Week

Unauthenticated directory traversal in kkFileView 5.0.0 through 5.0.2 lets remote attackers create arbitrary directories and write files outside the intended fileDir root via the fileUpload, createFolder, and existsFile endpoints, which concatenate an attacker-supplied 'path' parameter into the upload base path without any validation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms that no credentials and no user interaction are needed, and that the impact is integrity-only (C:N/A:N), meaning the attacker can plant content beyond the configured storage root but gains no direct read or availability effect. Exploitation is gated chiefly by exposure rather than configuration - kkFileView is typically deployed as an internal document-preview service - and no public exploit code was identified at time of analysis, so internet-facing, unauthenticated reachability of the upload endpoints is the real-world precondition for mass abuse.

CVE-2026-88592 Sep 16, 00:00 CRITICAL Act Now

Server-side request forgery in kkFileView 4.2.0 and later lets remote, unauthenticated attackers make the server fetch arbitrary URLs and read the echoed response body via the cross-origin file proxy endpoint /getCorsFile. The flaw is a validation/consumption mismatch: TrustHostFilter checks the first non-empty parameter in a fixed priority order against the trust.host whitelist, while the controller only reads and fetches urlPath, so a request supplying both a whitelisted decoy (url) and the real target (urlPath) passes validation and fetches the unvalidated target. Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - high confidentiality impact with no integrity or availability impact, somewhat lower than the vendor's 9.1 - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

CVE-2026-124556 Nov 09, 02:15 LOW Monitor

Open redirect in kekingcn kkFileView builds up to and including 5.0.3 allows remote attackers to steer users to attacker-chosen destinations by manipulating the X-Base-Url header consumed by BaseUrlFilter.getBaseUrl. No authentication is required (PR:N), but a victim must follow the crafted link (UI:P) before the redirect takes effect, and the impact ceiling is integrity-low with no code execution, data disclosure, or service disruption. A public exploit reference has been disclosed and the vendor did not respond to the report, so the practical risk is phishing and social-engineering abuse rather than direct compromise; assessed priority is 'this_month', not an emergency.

CVE-2025-4538 May 11, 11:15 MEDIUM This Month

A vulnerability was found in kkFileView 4.4.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-48815 Dec 04, 15:15 MEDIUM POC This Month

kkFileView v4.3.0 is vulnerable to Incorrect Access Control. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-4740 Dec 25, 20:15 MEDIUM POC This Month

A vulnerability, which was classified as problematic, has been found in kkFileView. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-43140 Nov 17, 17:15 HIGH POC This Week

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-42147 Oct 17, 21:15 MEDIUM This Month

kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-42149 Oct 17, 20:15 CRITICAL POC Act Now

kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-40879 Sep 29, 17:15 MEDIUM POC This Month

kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-36593 Sep 02, 04:15 MEDIUM POC This Month

kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-35151 Aug 17, 22:15 MEDIUM POC This Month

kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-29349 May 25, 01:15 MEDIUM POC This Month

kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.