Path Traversal in kkFileView File Upload Feature

Executive Summary

kkFileView versions 5.0.0 through 5.0.2 have a directory traversal flaw in FileController.java. The fileUpload, createFolder, and existsFile endpoints use a path parameter that is directly combined with the upload base directory without proper checks. This lets unauthenticated attackers create directories and write files anywhere on the system outside the intended fileDir root by sending a specially crafted multipart request.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to kkFileView endpoints like /fileUpload, /createFolder, or /existsFile with a path parameter containing directory traversal sequences (e.g., ../). Check server file systems for unexpected directories or files outside the intended upload directory.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to overwrite critical system files, plant malware, or execute arbitrary code on the server. This may lead to full system compromise, data theft, or denial of service. Unauthorized file creation outside the intended directory could also disrupt normal application operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade kkFileView to a version that patches this vulnerability. If no patch is available, disable the affected endpoints (fileUpload, createFolder, existsFile) in FileController.java. Ensure the fileDir root directory is properly restricted to prevent directory traversal.

Useful 0 Not Useful 0