CVE-2026-73244 in kkFileView
Summary
by MITRE • 08/11/2026
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The kkFileView application presents a critical directory traversal vulnerability through its unauthenticated POST endpoint at /listFiles which affects versions prior to 5.0.1. This flaw stems from insufficient input validation and path confinement mechanisms within the file listing functionality, creating a pathway for unauthorized directory enumeration beyond the intended demo directory scope. The vulnerability exists in server/src/main/java/cn/keking/web/controller/FileController.java where user-supplied path parameters are directly passed to Files.newDirectoryStream without proper sanitization or boundary enforcement.
The technical implementation of this vulnerability demonstrates a classic lack of input validation and access control measures that aligns with CWE-22 Directory Traversal and CWE-73 Improper Neutralization of Special Elements in Output. The FileController#getFiles method accepts user-controllable path parameters and forwards them directly to Java's Files.newDirectoryStream API without any validation against the intended demo directory boundaries. This design flaw enables attackers to traverse directories outside the designated file preview scope, potentially exposing sensitive system files, configuration data, or other unauthorized resources that should remain protected within the application's restricted access environment.
From an operational impact perspective, this vulnerability creates significant security risks for organizations deploying kkFileView applications. An attacker can enumerate directory structures across the entire file system, potentially discovering sensitive files such as database credentials, configuration files, source code repositories, or other confidential data stored on the server. The unauthenticated nature of this endpoint means that any external party can exploit this vulnerability without requiring valid credentials, making it particularly dangerous in production environments where the application may be exposed to public networks. This weakness directly violates the principle of least privilege and could enable further exploitation through information disclosure leading to more severe compromise scenarios.
The remediation for this vulnerability requires implementing strict path validation and confinement mechanisms that ensure all user-supplied paths are properly sanitized and restricted to the intended demo directory scope. Version 5.0.1 addresses this issue by introducing proper input validation that confines file access operations within the designated demo directory boundaries, preventing traversal beyond the intended root path. Organizations should implement parameter validation that checks for absolute paths, parent directory references, and other traversal patterns before allowing file system operations to proceed. This fix aligns with ATT&CK technique T1083 File and Directory Discovery which describes methods attackers use to enumerate file systems and identify sensitive information. Security measures should also include implementing proper authentication mechanisms for administrative functions and monitoring access logs for suspicious directory traversal attempts that could indicate exploitation attempts against similar vulnerabilities in other applications.