CVE-2026-95140: kkFileView Path Traversal Vulnerability

CVE-2026-95140 Overview

CVE-2026-95140 is a directory traversal vulnerability [CWE-22] affecting kkFileView versions 5.0.0 through 5.0.2. The flaw resides in FileController.java, where the fileUpload, createFolder, and existsFile endpoints accept a user-controlled path parameter. The application concatenates this parameter directly into the upload base path without validation. Unauthenticated attackers can send crafted multipart requests to create arbitrary directories and write arbitrary files outside the intended fileDir root. Successful exploitation compromises file system integrity on the host running kkFileView.

Critical Impact
Unauthenticated remote attackers can write arbitrary files outside the intended upload directory, enabling tampering with application files and potential follow-on code execution.

Affected Products

kkFileView v5.0.0
kkFileView v5.0.1
kkFileView v5.0.2

Discovery Timeline

2026-10-06 - CVE-2026-95140 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-95140

Vulnerability Analysis

kkFileView is an open-source document preview service used to render common office and media formats through a web interface. The vulnerable logic lives in FileController.java, which exposes three HTTP endpoints responsible for file management: fileUpload, createFolder, and existsFile. Each endpoint reads a path parameter from the HTTP request and appends it to the configured fileDir base directory. The resulting path is then used in file system operations without canonicalization or boundary checks.

Because the endpoints are reachable without authentication, an attacker only needs network access to the service. A crafted multipart request containing a path value such as ../../../ traverses out of the upload root. The attacker controls both the destination directory and the uploaded filename, which produces an arbitrary file write primitive. The scope of the issue is limited to integrity according to the CVSS vector, but writes to application directories or scheduled task locations may escalate impact depending on host configuration.

Root Cause

The root cause is missing input validation on the path parameter. The controller does not normalize the resolved path or verify that it remains within fileDir. Any traversal sequence passes through to the underlying file system APIs.

Attack Vector

An unauthenticated attacker sends an HTTP multipart POST request to the fileUpload endpoint. The request includes a path field containing traversal sequences and a file part with attacker-controlled content. The server resolves the path relative to fileDir, creates any missing directories, and writes the file to the attacker-chosen location.

// Conceptual request shape — see linked advisory for details
POST /fileUpload HTTP/1.1
Content-Type: multipart/form-data; boundary=----X

------X
Content-Disposition: form-data; name="path"

../../../<attacker-chosen-directory>/
------X
Content-Disposition: form-data; name="file"; filename="<attacker-chosen-file>"
Content-Type: application/octet-stream

<arbitrary bytes>
------X--

See the GitHub CVE Issue Discussion for additional technical context.

Detection Methods for CVE-2026-95140

Indicators of Compromise

Unexpected files or directories outside the configured fileDir root, especially under application binary or configuration paths.
HTTP POST requests to /fileUpload, /createFolder, or /existsFile containing ../ sequences in the path parameter.
New files written by the kkFileView service account in sensitive locations such as web root, startup scripts, or scheduled task directories.

Detection Strategies

Inspect web server and application logs for multipart requests to kkFileView endpoints where path contains traversal characters or URL-encoded equivalents such as %2e%2e%2f.
Alert on file creation events by the kkFileView process outside the configured upload directory.
Deploy web application firewall rules that reject path parameters containing .., backslashes, or absolute path prefixes.

Monitoring Recommendations

Enable file integrity monitoring on directories adjacent to the kkFileView installation and on OS-level persistence locations.
Centralize kkFileView access logs and correlate upload activity with downstream process execution.
Track unauthenticated POST volume to kkFileView endpoints as a baseline deviation signal.

How to Mitigate CVE-2026-95140

Immediate Actions Required

Restrict network access to kkFileView instances so only trusted internal clients can reach the upload endpoints.
Place kkFileView behind an authenticating reverse proxy if authentication cannot be enforced at the application layer.
Review the fileDir location and surrounding file system for unexpected files created since the service was deployed.

Patch Information

No fixed version is listed in the referenced advisory at the time of publication. Monitor the GitHub CVE Issue Discussion and the upstream kkFileView repository for a patched release and apply it once available.

Workarounds

Disable the fileUpload, createFolder, and existsFile endpoints at the reverse proxy if the file management features are not required.
Run kkFileView under a low-privileged service account with write access limited to the intended fileDir.
Enforce WAF rules that strip or reject path parameters containing traversal sequences on requests to kkFileView.

bash

# Example nginx rule to block path traversal in the path parameter
location ~ ^/(fileUpload|createFolder|existsFile) {
    if ($arg_path ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://kkfileview_upstream;
}