kkFileView
by kekingcn
Source repositories
CVEs (16)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-42149 | Cri | 0.64 | 9.8 | 0.02 | Oct 17, 2022 | kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java. | ||
| CVE-2021-43734 | Hig | 0.50 | 7.5 | 0.11 | Feb 15, 2022 | kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. | ||
| CVE-2022-43140 | Hig | 0.49 | 7.5 | 0.02 | Nov 17, 2022 | kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs… | ||
| CVE-2022-36593 | Med | 0.42 | 6.5 | 0.01 | Sep 2, 2022 | kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java. | ||
| CVE-2025-4538 | Med | 0.41 | 6.3 | 0.00 | May 11, 2025 | A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been… | ||
| CVE-2023-48815 | Med | 0.40 | 6.1 | 0.00 | Dec 4, 2023 | kkFileView v4.3.0 is vulnerable to Incorrect Access Control. | ||
| CVE-2022-46934 | Med | 0.40 | 6.1 | 0.01 | Feb 1, 2023 | kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. | ||
| CVE-2022-42147 | Med | 0.40 | 6.1 | 0.00 | Oct 17, 2022 | kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java. | ||
| CVE-2022-40879 | Med | 0.40 | 6.1 | 0.01 | Sep 29, 2022 | kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.' | ||
| CVE-2022-35151 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2022 | kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. | ||
| CVE-2022-29349 | Med | 0.40 | 6.1 | 0.02 | May 25, 2022 | kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. | ||
| CVE-2026-73243 | Med | 0.31 | 5.8 | 0.00 | Aug 11, 2026 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing… | ||
| CVE-2026-73244 | Med | 0.27 | 5.3 | 0.00 | Aug 11, 2026 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to… | ||
| CVE-2022-4740 | Low | 0.23 | 3.5 | 0.01 | Dec 25, 2022 | A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has… | ||
| CVE-2026-88592 | 0.00 | — | — | Sep 16, 2026 | kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the… | |||
| CVE-2026-88593 | 0.00 | — | — | Sep 16, 2026 | kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript… |
- risk 0.64cvss 9.8epss 0.02
kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.
- risk 0.50cvss 7.5epss 0.11
kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.
- risk 0.49cvss 7.5epss 0.02
kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs…
- risk 0.42cvss 6.5epss 0.01
kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java.
- risk 0.41cvss 6.3epss 0.00
A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been…
- risk 0.40cvss 6.1epss 0.00
kkFileView v4.3.0 is vulnerable to Incorrect Access Control.
- risk 0.40cvss 6.1epss 0.01
kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
- risk 0.40cvss 6.1epss 0.00
kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java.
- risk 0.40cvss 6.1epss 0.01
kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
- risk 0.40cvss 6.1epss 0.01
kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.
- risk 0.40cvss 6.1epss 0.02
kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
- risk 0.31cvss 5.8epss 0.00
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing…
- risk 0.27cvss 5.3epss 0.00
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to…
- risk 0.23cvss 3.5epss 0.01
A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has…
- CVE-2026-88592Sep 16, 2026risk 0.00cvss —epss —
kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the…
- CVE-2026-88593Sep 16, 2026risk 0.00cvss —epss —
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript…