Description

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-11T20:18:49.403Z",
  "pubdate": "2026-08-11T20:18:49.403Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability exists in kkFileView prior to version 5.0.1, specifically within the unauthenticated GET /addTask endpoint. This security flaw allows unauthenticated remote attackers to induce the affected system into fetching arbitrary attacker-selected URLs.\nThe root cause stems from the omission of the GET /addTask endpoint from the TrustHostFilter and TrustDirFilter security mechanisms located in server/src/main/java/cn/keking/config/WebConfig.java. By manipulating parameters, an attacker can bypass intended security constraints and interact with internal or external network resources.\nThe impact of this vulnerability includes potential unauthorized data access, network scanning, or interaction with internal services residing behind network perimeters. Exploitation requires network access to the target instance and no prior authentication or specific privileges, elevating the risk profile for exposed deployments.\nMitigation requires upgrading the kkFileView product to version 5.0.1 or later, where the security filters are properly enforced on the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides in the kkFileView universal file online preview project, specifically affecting versions prior to 5.0.1. The core component involved in the insecure request handling is located in server/src/main/java/cn/keking/config/WebConfig.java.\nThe vulnerability mechanism initiates when an unauthenticated client sends a GET request to the /addTask endpoint. Crucially, this endpoint was omitted from the TrustHostFilter and TrustDirFilter filters responsible for validating and restricting destination hosts and directories.\nDuring execution, the application utilizes FileHandlerService#getFileAttribute, where an attacker can supply a manipulated fullfilename parameter. This parameter forces the application to process the request as an OFFICE, COMPRESS, or CAD file type. Consequently, this classification triggers the FileConvertQueueTask mechanism, which subsequently attempts to fetch the file or resource from the attacker-selected URL.\nBecause the trust filters are bypassed, the server initiates outbound HTTP or network requests to arbitrary destinations specified by the malicious input. Attackers can leverage this behavior to probe internal networks, access restricted metadata services, or interact with loopback interfaces that are otherwise protected from direct external access.\nThe attack flow requires zero authentication and no special privileges, making any publicly exposed instance running vulnerable versions susceptible to remote exploitation over the network."
}