CVE-2026-73244

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73244
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73244.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73244
Aliases
  • GHSA-pmp8-g8p2-p6jq
Published
2026-08-11T20:08:25Z
Modified
2026-09-11T08:36:51Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing
Details

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73244.json"
}
References

Affected packages

Git / github.com/kekingcn/kkfileview

Affected ranges

Type
GIT
Repo
https://github.com/kekingcn/kkfileview
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
47745e4d74112000fcc4f0664e2fc751e6cf9bae
Fixed
e134689df3d9c6ae48749d42cc282d9920dd0813
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.2
v0.*
v0.0.2
v1.*
v1.0
v1.1
v2.*
v2.0
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.1.2
v2.2.0
v2.2.0-SNAPSHOT
v2.2.1
v3.*
v3.3.0
v3.5
v3.5.1
v3.6.0
v4.*
v4.0.0
v4.1.0
v4.2.0
v4.2.1
v4.3.0
v4.4.0
v4.4.0-beta
v5.*
v5.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73244.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "228822563573825293952279168647553423223",
                "82476718794274561807936555643870779420",
                "44824430287999437057015555887667515639",
                "295776024517750380090261865488681407365",
                "330705987956134442155937797770202711149",
                "34323208140470333733959740317196823277",
                "303000508949298444259712928797968219275",
                "142150652753679224322322585828748113022",
                "317582553612700794024957112534767019628",
                "126533029421496734464417882198450523128",
                "53191996476128732108055819718740108197",
                "126710955017527280438937073109825213550",
                "69524637886774661656166023469473777946",
                "264795427066151842693338984073720163256",
                "178699693924874427926876066175061520052",
                "137069829091512648016996230595236288987",
                "72164402642864499283572938195851356300",
                "155138031788998098237211284716152253198",
                "173956021832294362451004403159717888246",
                "186576335517076043543609448174438259084",
                "136051709085700999682641032647287599406",
                "277162308417356861906969804371776931238",
                "16646646956182803693163291965178084381",
                "46238897817593062372254271353694669566",
                "147492047096412963213072937496413554195",
                "202183947125104187658649634256625229238",
                "152968617407739565101121715059222334922"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-73244-1014b0e0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kekingcn/kkfileview/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae",
        "target": {
            "file": "server/src/main/java/cn/keking/web/controller/FileController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "282907774384278750988476564785273516345",
            "length": 4008
        },
        "id": "CVE-2026-73244-d841cbd3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/kekingcn/kkfileview/commit/47745e4d74112000fcc4f0664e2fc751e6cf9bae",
        "target": {
            "file": "server/src/main/java/cn/keking/web/controller/FileController.java",
            "function": "getFiles"
        }
    }
]
vanir_signatures_modified 
"2026-09-11T08:36:51Z"