CVE-2026-73244 — kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/co…
Published: 2026-08-11 · CVSS: 5.3 · CVSS 3.1
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7