CVE-2026-88593: kkFileView Reflected XSS Vulnerability

CVE-2026-88593 Overview

CVE-2026-88593 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in kkFileView versions 5.0.0 through 5.0.2. The flaw resides in the /onlinePreview endpoint, where the OnlinePreviewController forwards user-controlled page and kkagent request parameters to FreeMarker templates without sanitization. The templates then embed these values directly into raw JavaScript contexts, allowing attackers to inject executable script through crafted URLs.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session by delivering a malicious /onlinePreview URL, enabling session hijacking, credential theft, and unauthorized actions within the kkFileView application.

Affected Products

kkFileView 5.0.0
kkFileView 5.0.1
kkFileView 5.0.2

Discovery Timeline

2026-09-16 - CVE-2026-88593 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-88593

Vulnerability Analysis

kkFileView is an open-source document preview service that renders office documents, images, and other file formats through a web interface. The /onlinePreview endpoint accepts request parameters used to control rendering behavior, including page and kkagent. The OnlinePreviewController passes these parameters directly to FreeMarker template models without applying HTML or JavaScript encoding.

The FreeMarker templates then interpolate the parameter values into <script> blocks. Because the values land inside a raw JavaScript context, attackers can break out of intended string literals and inject arbitrary script. Any user who clicks a crafted link executes attacker-controlled code in the origin of the vulnerable kkFileView instance.

Root Cause

The root cause is missing output encoding for user-controlled input rendered into a JavaScript execution context. FreeMarker's default HTML escaping does not neutralize JavaScript syntax such as quotes, backslashes, or control characters. The controller layer also fails to validate or sanitize the page and kkagent parameters before handing them to the view layer.

Attack Vector

Exploitation requires a victim to load a crafted URL pointing to a vulnerable kkFileView deployment. The attacker embeds JavaScript payloads within the page or kkagent query parameters. Delivery typically occurs through phishing links, malicious documents, or third-party sites embedding the URL. Once executed, the script runs with the privileges of the victim's session in the kkFileView origin.

Refer to the GitHub Issue: CVE Discussion for additional technical context on the vulnerable parameters and templates.

Detection Methods for CVE-2026-88593

Indicators of Compromise

Requests to /onlinePreview containing suspicious characters in the page or kkagent parameters, such as <script, %3Cscript, onerror=, javascript:, or unescaped quotes and angle brackets.
Unusual referrers or external origins driving traffic to /onlinePreview with long or encoded query strings.
Browser console errors or Content Security Policy (CSP) violation reports originating from kkFileView pages.

Detection Strategies

Inspect web server and reverse proxy access logs for /onlinePreview requests where page or kkagent parameters contain HTML or JavaScript metacharacters.
Deploy a web application firewall (WAF) rule that flags reflected XSS payload patterns targeting the two vulnerable parameters.
Use dynamic application security testing (DAST) tools to fuzz the /onlinePreview endpoint and confirm sanitization is in place after patching.

Monitoring Recommendations

Enable CSP reporting on kkFileView deployments and forward violation reports to centralized logging for review.
Alert on outbound requests from user browsers to unexpected domains immediately after loading /onlinePreview URLs.
Track authentication anomalies such as session reuse from new IP addresses following interactions with the preview endpoint.

How to Mitigate CVE-2026-88593

Immediate Actions Required

Restrict public exposure of kkFileView instances by placing them behind authenticated reverse proxies or VPNs until a fixed version is deployed.
Add a WAF rule that blocks requests to /onlinePreview when the page or kkagent parameters contain script tags, event handlers, or JavaScript URI schemes.
Notify users to avoid clicking untrusted links that reference the kkFileView host.

Patch Information

At the time of publication, no vendor-confirmed fixed release is referenced in the NVD entry for CVE-2026-88593. Monitor the kkFileView GitHub CVE discussion and upstream project releases for a patched version, and upgrade beyond the affected 5.0.0–5.0.2 range once available.

Workarounds

Configure the reverse proxy to strip or reject the page and kkagent query parameters when their values contain non-alphanumeric characters.
Apply a strict Content Security Policy that disallows inline scripts, mitigating execution of injected payloads in the FreeMarker output.
Enable HttpOnly and Secure flags on kkFileView session cookies to reduce the impact of successful script execution.

bash

# Example NGINX rule to block suspicious /onlinePreview parameters
location /onlinePreview {
    if ($arg_page ~* "[<>\"']|script|javascript:|on\w+=") { return 403; }
    if ($arg_kkagent ~* "[<>\"']|script|javascript:|on\w+=") { return 403; }
    proxy_pass http://kkfileview_backend;
}