{"id":"CVE-2026-73244","summary":"kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing","details":"kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.","aliases":["GHSA-pmp8-g8p2-p6jq"],"modified":"2026-09-11T08:36:51.369717Z","published":"2026-08-11T20:08:25.054Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73244.json"},"references":[{"type":"WEB","url":"https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73244.json"},{"type":"ADVISORY","url":"https://github.com/kekingcn/kkFileView/security/advisories/GHSA-pmp8-g8p2-p6jq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73244"},{"type":"FIX","url":"https://github.com/kekingcn/kkFileView/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kekingcn/kkfileview","events":[{"introduced":"0"},{"fixed":"47745e4d74112000fcc4f0664e2fc751e6cf9bae"},{"fixed":"e134689df3d9c6ae48749d42cc282d9920dd0813"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.0.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v5.0.0","v4.4.0","v4.4.0-beta","v4.3.0","v4.2.1","v4.2.0","v4.1.0","v4.0.0","v3.6.0","v3.5.1","v3.5","v3.3.0","v2.2.1","v2.2.0","v2.2.0-SNAPSHOT","v2.1.2","v2.1.1","v2.1.0","v2.0.2","v2.0.1","v2.0","v1.1","v1.0","v0.0.2","0.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73244.json","vanir_signatures_modified":"2026-09-11T08:36:51Z","vanir_signatures":[{"id":"CVE-2026-73244-1014b0e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/kekingcn/kkfileview/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae","target":{"file":"server/src/main/java/cn/keking/web/controller/FileController.java"},"deprecated":false,"digest":{"line_hashes":["228822563573825293952279168647553423223","82476718794274561807936555643870779420","44824430287999437057015555887667515639","295776024517750380090261865488681407365","330705987956134442155937797770202711149","34323208140470333733959740317196823277","303000508949298444259712928797968219275","142150652753679224322322585828748113022","317582553612700794024957112534767019628","126533029421496734464417882198450523128","53191996476128732108055819718740108197","126710955017527280438937073109825213550","69524637886774661656166023469473777946","264795427066151842693338984073720163256","178699693924874427926876066175061520052","137069829091512648016996230595236288987","72164402642864499283572938195851356300","155138031788998098237211284716152253198","173956021832294362451004403159717888246","186576335517076043543609448174438259084","136051709085700999682641032647287599406","277162308417356861906969804371776931238","16646646956182803693163291965178084381","46238897817593062372254271353694669566","147492047096412963213072937496413554195","202183947125104187658649634256625229238","152968617407739565101121715059222334922"],"threshold":0.9}},{"id":"CVE-2026-73244-d841cbd3","signature_type":"Function","signature_version":"v1","source":"https://github.com/kekingcn/kkfileview/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae","target":{"file":"server/src/main/java/cn/keking/web/controller/FileController.java","function":"getFiles"},"deprecated":false,"digest":{"function_hash":"282907774384278750988476564785273516345","length":4008}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}