CVE-2026-124556: kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect
A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects kekingcn kkFileView versions up to and including 5.0.3. The available information does not identify any unaffected fixed version.
What does an attacker need to exploit this issue?
The attack can be performed remotely and does not require privileges, but it requires user interaction. Exploitation involves manipulating the X-Base-Url argument to cause an open redirect.
Is there public exploit information?
Yes. The exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond according to the available disclosure.