Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73244kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing

Medium 5.3

In plain English

A medium-severity path traversal in kkFileView from kekingcn. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 61.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.

Affected products (as reported)

Vendor	Product	Versions
kekingcn	kkFileView	< 5.0.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq x_refsource_CONFIRM
https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae x_refsource_MISC
https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1 x_refsource_MISC