CVE-2026-73244: kkFileView Path Traversal Vulnerability

CVE-2026-73244 Overview

CVE-2026-73244 is a path traversal vulnerability [CWE-22] in kkFileView, a universal file online preview project built on Spring Boot. The unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java accepts a user-controlled path parameter and passes it directly to Files.newDirectoryStream without confining the value to the intended demo directory. Remote attackers can enumerate directories outside the intended root, exposing filesystem structure and file names to unauthenticated network clients. The issue affects kkFileView versions prior to 5.0.1 and is fixed in version 5.0.1.

Critical Impact
Unauthenticated remote attackers can enumerate arbitrary directories on the host filesystem, disclosing sensitive file and directory names outside the application's demo root.

Affected Products

kkFileView versions prior to 5.0.1
Spring Boot deployments exposing the FileController#getFiles handler
Applications built on the kekingcn/kkFileView upstream project

Discovery Timeline

2026-08-11 - CVE-2026-73244 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73244

Vulnerability Analysis

The flaw resides in the FileController#getFiles handler that services the POST /listFiles endpoint. The controller reads a path request parameter and forwards it unchanged to java.nio.file.Files.newDirectoryStream. Because no normalization or containment check confines the resolved path to the configured demo directory, an attacker can supply absolute paths or .. sequences to traverse the filesystem.

The endpoint requires no authentication, so exploitation only requires network reachability to the kkFileView instance. The disclosed information is limited to directory listings, aligning with the confidentiality-only impact classification.

Root Cause

The underlying defect is missing input validation on a filesystem path derived from untrusted input, a canonical [CWE-22] path traversal pattern. The controller trusts the client-supplied path, resolves it with Paths.get, and iterates its contents without verifying that the resolved path stays within the application's demo directory boundary.

Attack Vector

An attacker sends an unauthenticated POST request to /listFiles with a crafted path parameter pointing to a directory outside the demo root. The server responds with the enumeration of that directory, revealing filenames and subdirectory names. Repeated requests allow the attacker to map filesystem layout and identify sensitive files for follow-on attacks.

java

 import java.io.OutputStream;
 import java.nio.file.DirectoryStream;
 import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.nio.file.attribute.BasicFileAttributes;

Source: GitHub Commit 47745e4. The patch introduces InvalidPathException handling and confinement checks in FileController.java to reject paths that escape the demo directory.

Detection Methods for CVE-2026-73244

Indicators of Compromise

HTTP POST requests to /listFiles containing path parameter values with .., absolute paths such as /etc, /root, or Windows drive prefixes like C:\.
Anomalous directory listing responses returned from kkFileView instances to unauthenticated clients.
Repeated /listFiles requests from a single source IP scanning multiple filesystem locations.

Detection Strategies

Inspect web server and application logs for POST /listFiles requests whose path parameter contains traversal sequences or references paths outside the configured demo directory.
Deploy web application firewall rules that block or alert on traversal patterns in the path parameter of /listFiles requests.
Correlate kkFileView access logs with process-level file access telemetry to identify enumeration attempts against sensitive directories.

Monitoring Recommendations

Enable verbose request logging on the kkFileView reverse proxy to capture full request bodies for /listFiles.
Alert on any unauthenticated access to /listFiles from external network zones.
Track the kkFileView deployment version via automated software inventory to identify hosts still running versions prior to 5.0.1.

How to Mitigate CVE-2026-73244

Immediate Actions Required

Upgrade kkFileView to version 5.0.1 or later, which contains the official fix.
Restrict network access to the kkFileView instance so that only trusted application backends can reach the /listFiles endpoint.
Review historical access logs for prior exploitation of /listFiles with traversal payloads.

Patch Information

The fix is delivered in kkFileView v5.0.1. The change is described in GitHub Security Advisory GHSA-pmp8-g8p2-p6jq and implemented in commit 47745e4, which confines the path parameter to the demo directory and rejects invalid path input.

Workarounds

Block the /listFiles endpoint at a reverse proxy or web application firewall until the upgrade is applied.
Require authentication in front of kkFileView using an ingress-level auth proxy.
Filter incoming requests to strip path parameter values containing .., absolute paths, or drive letters.

bash

# Nginx example: block unauthenticated /listFiles requests
location = /listFiles {
    return 403;
}