CVE-2026-73243: kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kkFileViewto a version that resolves this vulnerability.Fixed in 5.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73243?
CVE-2026-73243 has a severity rating of medium, with a score of 5.8.
How do I fix CVE-2026-73243?
To mitigate CVE-2026-73243, update your kkFileView instance to version 5.0.1 or later.
What type of vulnerability is CVE-2026-73243?
CVE-2026-73243 is classified as an SSRF (Server-Side Request Forgery) vulnerability.
What are the potential impacts of CVE-2026-73243?
CVE-2026-73243 can allow unauthorized access to internal resources and sensitive files due to the lack of validation.
What does the CVSS vector for CVE-2026-73243 indicate?
The CVSS vector for CVE-2026-73243 indicates an attack vector of network, with access complexity being low and requiring no privileges.