CVE-2026-73244: kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kkFileViewto a version that resolves this vulnerability.Fixed in 5.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73244?
The severity of CVE-2026-73244 is rated as medium with a score of 5.3.
What impact does CVE-2026-73244 have?
CVE-2026-73244 allows unauthenticated path traversal leading to arbitrary directory listing.
How do I fix CVE-2026-73244?
To fix CVE-2026-73244, update kkFileView to version 5.0.1 or later.
What software is affected by CVE-2026-73244?
The affected software for CVE-2026-73244 is kkFileView prior to version 5.0.1.
Is authentication required to exploit CVE-2026-73244?
No, CVE-2026-73244 can be exploited without authentication.