CVE-2026-73244
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.
Schwachstellenklasse
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.
Quellen
- https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae
- https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1
- https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq
- https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.