CVE-2026-95140: Path Traversal

Q: Which deployments are affected?

The affected versions are kkFileView v5.0.0 through v5.0.2. The vulnerable functionality is in FileController.java and involves the fileUpload, createFolder, and existsFile endpoints.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network-reachable, low-complexity exploitation with no privileges required and no user interaction required.

Q: What can an attacker do by exploiting this issue?

An attacker can use a crafted multipart request with a traversal sequence in the path parameter to create directories and write files outside the intended fileDir root. The reported impact is integrity-focused; confidentiality and availability impacts are not indicated.

Published Oct 6, 2026

Updated

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request

Affected Software

1 affected component

kkFileView kkFileView>=5.0.0<=5.0.2

Event History

Oct 6, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The affected versions are kkFileView v5.0.0 through v5.0.2. The vulnerable functionality is in FileController.java and involves the fileUpload, createFolder, and existsFile endpoints.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates network-reachable, low-complexity exploitation with no privileges required and no user interaction required.

What can an attacker do by exploiting this issue?

An attacker can use a crafted multipart request with a traversal sequence in the path parameter to create directories and write files outside the intended fileDir root. The reported impact is integrity-focused; confidentiality and availability impacts are not indicated.

CVE-2026-95140: Path Traversal

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What can an attacker do by exploiting this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What can an attacker do by exploiting this issue?