CVE-2026-73243

Received Received - Intake

Unauthenticated File URL Fetch in kkFileView

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73243

EUVD

EUVD-2026-56937

Affected Vendors & Products

Vendor	Product	Version / Range
kekingcn	kkfileview	to 5.0.1 (inc)
kekingcn	kkfileview	to 5.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-73243 is a Server-Side Request Forgery (SSRF) vulnerability in kkFileView version 5.0.0. The /addTask endpoint is not protected by TrustHostFilter or TrustDirFilter, allowing unauthenticated attackers to send crafted requests with a fullfilename parameter to force the server to fetch an arbitrary URL as an OFFICE, COMPRESS, or CAD file type. This bypasses type validation and enables blind SSRF attacks.

Detection Guidance

Check if the /addTask endpoint is accessible without authentication by sending a GET request to it. Monitor outbound HTTP requests from the server to detect unauthorized connections to internal or external hosts. Inspect logs for requests containing base64-encoded URLs in the fullfilename parameter.

Impact Analysis

An attacker could exploit this to make the server send requests to internal or external hosts, potentially leaking sensitive data like cloud metadata (e.g., AWS IAM credentials), probing internal networks, or accessing restricted resources. The attack requires no privileges or user interaction and is exploitable in default configurations.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles (e.g., Article 32 on security of processing) and HIPAA's requirements for safeguarding protected health information. Organizations using vulnerable versions may face compliance breaches and regulatory penalties.

Mitigation Strategies

Upgrade kkFileView to version 5.0.1 or later. Ensure the /addTask endpoint is included in TrustHostFilter and TrustDirFilter. Disable the /addTask endpoint if not required by setting kk.addTask=false. Implement strict allowlists for hosts and schemes in the configuration.

Hi! I’m here to help you understand CVE-2026-73243. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70