CVE-2026-88592: kkFileView SSRF Vulnerability

CVE-2026-88592 Overview

CVE-2026-88592 is a Server-Side Request Forgery (SSRF) vulnerability affecting kkFileView versions 4.2.0 and later. The flaw resides in the cross-origin file proxy endpoint /getCorsFile, which is guarded by a TrustHostFilter that enforces a trust.host whitelist. Attackers exploit a parameter-parsing mismatch between the filter and the controller to bypass the whitelist. The server fetches an attacker-chosen URL and echoes the response body back, enabling internal network reconnaissance and access to metadata services.

Critical Impact
Unauthenticated attackers can coerce the kkFileView server to fetch arbitrary URLs and receive the response, exposing internal services, cloud metadata endpoints, and restricted resources.

Affected Products

kkFileView 4.2.0
kkFileView versions later than 4.2.0
Deployments exposing the /getCorsFile endpoint

Discovery Timeline

2026-09-16 - CVE-2026-88592 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-88592

Vulnerability Analysis

kkFileView exposes /getCorsFile to proxy cross-origin file content. The endpoint is protected by TrustHostFilter, which validates a request parameter against the trust.host whitelist before allowing the request to reach the controller. The filter and controller disagree on which parameter carries the target URL, creating an exploitable parsing gap. This desynchronization allows attackers to submit a whitelisted decoy for validation and an unrelated target for the actual fetch. The response body from the unvalidated fetch returns to the attacker, satisfying the classic SSRF impact pattern [CWE-918].

Root Cause

The root cause is inconsistent parameter selection between security enforcement and business logic. TrustHostFilter iterates over a fixed priority order of parameter names and validates the first non-empty value it finds. The controller, however, unconditionally reads only the urlPath parameter and issues an outbound HTTP request against it. When both url and urlPath are supplied, the filter inspects one while the controller fetches the other, so whitelist enforcement never covers the value that is actually requested.

Attack Vector

An unauthenticated attacker sends a single HTTP request to /getCorsFile containing two parameters. The url parameter is set to a value listed in trust.host, satisfying the filter check. The urlPath parameter is set to the real target, such as an internal IP address, a cloud metadata service endpoint like http://169.254.169.254/, or a service listening on localhost. The server-side HTTP client dereferences urlPath, retrieves the resource, and returns the body in the HTTP response. See the GitHub CVE Issue Discussion for the reported parameter interaction.

Detection Methods for CVE-2026-88592

Indicators of Compromise

HTTP requests to /getCorsFile containing both url and urlPath query parameters in the same request.
Outbound connections from the kkFileView host to RFC1918 addresses, 127.0.0.1, or link-local addresses such as 169.254.169.254.
Access log entries where the urlPath value points to a host not present in the configured trust.host allowlist.
Unusual spikes in /getCorsFile traffic from a single source IP or user agent.

Detection Strategies

Parse kkFileView access logs and flag any request to /getCorsFile that includes more than one URL-carrying parameter.
Correlate application logs with egress firewall logs to identify server-initiated requests to internal or cloud metadata ranges.
Deploy a web application firewall rule that blocks or alerts on /getCorsFile requests where urlPath resolves to a non-whitelisted host.

Monitoring Recommendations

Alert on any DNS resolution or TCP connection from the kkFileView JVM to internal management subnets or cloud metadata IPs.
Track HTTP 200 responses from /getCorsFile where the response Content-Length or Content-Type differs from typical proxied file traffic.
Baseline normal trust.host targets and alert when observed urlPath values fall outside that baseline.

How to Mitigate CVE-2026-88592

Immediate Actions Required

Restrict network egress from the kkFileView server so it cannot reach internal management interfaces or cloud metadata endpoints.
Block or disable public exposure of the /getCorsFile endpoint at the reverse proxy or WAF until a patched build is deployed.
Audit trust.host configuration and remove wildcard or overly permissive entries that expand exploit reach.

Patch Information

No official vendor patch reference is included in the enriched CVE data at the time of publication. Monitor the GitHub CVE Issue Discussion and the kkFileView project repository for a fixed release that aligns filter validation with the controller-consumed parameter.

Workarounds

Add a reverse proxy rule that rejects /getCorsFile requests carrying both url and urlPath parameters simultaneously.
Enforce an egress allowlist on the kkFileView host limiting outbound HTTP traffic to known document sources.
Deploy a WAF signature that validates the urlPath parameter against the same allowlist configured for trust.host.
Run kkFileView inside a network segment that has no route to internal services or cloud instance metadata endpoints.

bash

# Example NGINX reverse proxy rule to block dual-parameter requests
location /getCorsFile {
    if ($arg_url != "") {
        if ($arg_urlPath != "") {
            return 403;
        }
    }
    proxy_pass http://kkfileview_backend;
}