CVE-2026-73243

5.8 Moyenne

Publiée le 11/08/2026 à 22:18 · Modifiée le 09/09/2026 à 22:46 · Analyse NVD reportée · Source : security-advisories@github.com

Description

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.

Traduire en français

Produits concernés

kekingcn kkFileView

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.8 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/kekingcn/kkFileView/commit/32a887aa2cd70228998c617c4e7df6cfcf3fe709
https://github.com/kekingcn/kkFileView/issues/765
https://github.com/kekingcn/kkFileView/pull/767
https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1
https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m
https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories