CVE-2026-73243 in kkFileView
Summary
by MITRE • 08/11/2026
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in kkFileView represents a critical security flaw that enables unauthorized remote code execution through improper input validation and access control mechanisms. This issue affects versions prior to 5.0.1 of the Spring Boot based file preview application, where the application fails to properly validate user inputs before processing file conversion requests. The core problem lies within the WebConfig.java configuration file where specific endpoints are not adequately protected by security filters, creating an attack vector that allows malicious actors to manipulate file handling processes.
The technical implementation of this vulnerability exploits the TrustHostFilter and TrustDirFilter mechanisms that are designed to restrict file access to trusted sources. However, the GET endpoint at /addTask is explicitly excluded from these protective measures, allowing attackers to bypass normal security constraints. When an attacker submits a request through this endpoint, the FileConvertQueueTask component can retrieve and process files from arbitrary URLs specified by the attacker, rather than being limited to predefined trusted sources. This occurs because the FileHandlerService#getFileAttribute method uses the fullfilename parameter to force specific file type handling for OFFICE, COMPRESS, or CAD formats, which then triggers the vulnerable conversion process.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates a pathway for remote code execution and arbitrary file processing. Attackers can leverage this flaw to download and execute malicious files from external servers, potentially leading to complete system compromise. The vulnerability essentially allows an unauthenticated attacker to perform file operations against the application's underlying file processing infrastructure, which could result in data exfiltration, system infiltration, or denial of service conditions. This represents a severe authorization bypass that violates fundamental security principles.
Security mitigations for this vulnerability should focus on implementing proper input validation and access control measures. The fix implemented in version 5.0.1 addresses the root cause by ensuring that all endpoints are properly protected by the TrustHostFilter and TrustDirFilter mechanisms, preventing unauthorized URL resolution during file conversion processes. Organizations should also implement additional security controls such as network segmentation, firewall rules to restrict access to sensitive endpoints, and regular security auditing of application configurations. This vulnerability aligns with CWE-284 (Improper Access Control) and could be categorized under ATT&CK technique T1059 (Command and Scripting Interpreter) when exploited for remote code execution.
The broader implications of this flaw highlight the importance of proper security configuration management in web applications, particularly those handling file processing operations. Applications must ensure that all input parameters are validated against trusted sources and that access controls are consistently applied across all endpoints. This vulnerability demonstrates how a single misconfiguration in security filters can create a complete bypass of file access restrictions, emphasizing the need for comprehensive security testing and review processes during application development lifecycle phases.