CVE-2026-88593: XSS

Q: How can I determine whether my deployment is affected?

Deployments running kkFileView versions 5.0.0 through 5.0.2 are affected. The issue is associated with requests to the /onlinePreview endpoint.

Q: Which request parameters should be reviewed for exploit attempts?

The user-controlled page and kkagent parameters are passed to FreeMarker templates and inserted into raw JavaScript contexts. Requests to /onlinePreview containing unexpected or script-like values in these parameters should be investigated.

Published Sep 16, 2026

Updated

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.

Affected Software

1 affected component

kkFileView kkFileView>=5.0.0<=5.0.2

Event History

Sep 16, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

How can I determine whether my deployment is affected?

Deployments running kkFileView versions 5.0.0 through 5.0.2 are affected. The issue is associated with requests to the /onlinePreview endpoint.

Which request parameters should be reviewed for exploit attempts?

The user-controlled page and kkagent parameters are passed to FreeMarker templates and inserted into raw JavaScript contexts. Requests to /onlinePreview containing unexpected or script-like values in these parameters should be investigated.