CVE-2026-73244

5.3 Moyenne

Publiée le 11/08/2026 à 22:18 · Modifiée le 09/09/2026 à 22:46 · Analyse NVD reportée · Source : security-advisories@github.com

Description

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.

Traduire en français

Produits concernés

kekingcn kkFileView

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-22

Références

https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae
https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1
https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq
https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories