CVE-2026-73243

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.

• CWE-918

• https://github.com/kekingcn/kkFileView/commit/32a887aa2cd70228998c617c4e7df6cfcf3fe709
• https://github.com/kekingcn/kkFileView/issues/765
• https://github.com/kekingcn/kkFileView/pull/767
• https://github.com/kekingcn/kkFileView/releases/tag/v5.0.1
• https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m
• https://github.com/kekingcn/kkFileView/security/advisories/GHSA-gwwj-52hv-6g2m

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73233FreeCAD is a free and open-source multiplatform 3D parametri…8.5
• CVE-2026-73234FreeCAD is a free and open-source multiplatform 3D parametri…7.8
• CVE-2026-73235FreeCAD is a free and open-source multiplatform 3D parametri…6.1
• CVE-2026-7324Memory safety bugs present in Thunderbird 150.0.0. Some of t…7.3
• CVE-2026-73241FreeRDP is a free implementation of the Remote Desktop Proto…8.3
• CVE-2026-73242FreeRDP is a free implementation of the Remote Desktop Proto…8.3
• CVE-2026-73244kkFileView is a universal file online preview project based …5.3
• CVE-2026-73245Kestra is an open-source, event-driven orchestration platfor…6.5
• CVE-2026-73246Kestra is an open-source, event-driven orchestration platfor…7.5
• CVE-2026-73247Kestra is an open-source, event-driven orchestration platfor…8.6
• CVE-2026-73248calibre is an e-book manager. Prior to 9.12.0, calibre proce…8.5
• CVE-2026-73249calibre is an e-book manager. Prior to 9.12.0, the calibre C…7.5