CyberRota Analysis
AI-GeneratedThe kkFileView project, prior to version 5.0.1, contains a vulnerability in the unauthenticated POST /listFiles endpoint that allows attackers to exploit user-controlled path parameters, leading to potential directory enumeration beyond the intended root directory. This could expose sensitive file structures and contents to unauthorized users. Organizations using affected versions of kkFileView should prioritize upgrading to version 5.0.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.