CVE-2026-73243: kkFileView Path Traversal Vulnerability

CVE-2026-73243 Overview

CVE-2026-73243 is a Server-Side Request Forgery (SSRF) vulnerability in kkFileView, a universal file online preview project based on Spring Boot. The flaw exists in versions prior to 5.0.1. The unauthenticated GET /addTask endpoint is omitted from both TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java. This omission allows FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD content type. The issue is fixed in version 5.0.1 and is classified under CWE-918.

Critical Impact
Unauthenticated remote attackers can coerce the kkFileView server to issue HTTP requests to attacker-chosen URLs, enabling reconnaissance of internal networks and interaction with internal services.

Affected Products

kkFileView versions prior to 5.0.1
Spring Boot-based deployments exposing the /addTask endpoint
Fixed in kkFileView 5.0.1

Discovery Timeline

2026-08-11 - CVE-2026-73243 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73243

Vulnerability Analysis

kkFileView registers TrustHostFilter and TrustDirFilter in WebConfig.java to restrict which endpoints can trigger outbound file fetches. Prior to version 5.0.1, the /addTask endpoint was not included in the filter's URI list. This allowed unauthenticated attackers to submit requests that queued a file conversion task pointing at an arbitrary URL.

When the task executes, FileHandlerService#getFileAttribute inspects the supplied fullfilename parameter to determine the content type. By providing a filename with an extension mapped to OFFICE, COMPRESS, or CAD categories, the attacker forces the server to fetch the specified URL for processing. The server then performs the outbound HTTP request from its own network context.

Root Cause

The root cause is missing endpoint coverage in the trust filter configuration. The /addTask handler was reachable without host or directory validation, breaking the intended enforcement boundary for outbound fetches.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to /addTask with a crafted url parameter and a fullfilename value whose extension matches OFFICE, COMPRESS, or CAD types. The kkFileView server queues the task and issues a request to the attacker-selected URL. Because the request originates server-side, attackers can reach internal-only hosts, cloud metadata endpoints, and services otherwise inaccessible from the public internet.

java

         filterUri.add("/onlinePreview");
         filterUri.add("/picturesPreview");
         filterUri.add("/getCorsFile");
+        filterUri.add("/addTask");
         TrustHostFilter filter = new TrustHostFilter();
         FilterRegistrationBean<TrustHostFilter> registrationBean = new FilterRegistrationBean<>();
         registrationBean.setFilter(filter);
// Source: https://github.com/kekingcn/kkFileView/commit/32a887aa2cd70228998c617c4e7df6cfcf3fe709
// The patch adds /addTask to the TrustHostFilter URI list, ensuring the endpoint is subject to host validation.

Detection Methods for CVE-2026-73243

Indicators of Compromise

HTTP access log entries for GET /addTask requests containing url= and fullfilename= parameters from untrusted sources.
Outbound connections from the kkFileView host to internal RFC1918 addresses, cloud metadata endpoints (169.254.169.254), or unexpected external hosts.
File conversion queue entries referencing remote URLs that do not match legitimate document sources.

Detection Strategies

Inspect application access logs for unauthenticated requests to /addTask and correlate with subsequent outbound traffic from the kkFileView process.
Alert on requests to /addTask where the fullfilename parameter uses OFFICE, COMPRESS, or CAD extensions paired with off-domain URLs.
Baseline normal outbound destinations for the kkFileView host and flag deviations, particularly requests to internal address space.

Monitoring Recommendations

Enable verbose logging on the kkFileView Spring Boot application to capture request URIs and parameters.
Forward web server and application logs to a centralized analytics platform for correlation with network telemetry.
Monitor egress firewall logs for connections originating from the file preview server to sensitive internal ranges.

How to Mitigate CVE-2026-73243

Immediate Actions Required

Upgrade kkFileView to version 5.0.1 or later, which adds /addTask to the trust filter configuration.
Restrict network egress from the kkFileView host to only the destinations required for legitimate document sources.
Place the kkFileView instance behind an authenticating reverse proxy if it must remain internet-exposed.

Patch Information

The fix is available in kkFileView release v5.0.1. The corresponding security advisory GHSA-gwwj-52hv-6g2m documents the vulnerability, and the patch commit adds /addTask to the TrustHostFilter URI list. Additional context is available in the GitHub issue and pull request #767.

Workarounds

Block or filter access to the /addTask endpoint at a reverse proxy or web application firewall until the upgrade can be applied.
Configure network policies that prevent the kkFileView host from reaching internal management interfaces and cloud metadata services.
Require authentication in front of kkFileView so anonymous callers cannot reach the vulnerable endpoint.

bash

# Example nginx snippet to block unauthenticated /addTask access
location = /addTask {
    deny all;
    return 403;
}