Executive brief
kkFileView is a file preview service used to display documents and media files in web applications. A Server-Side Request Forgery (SSRF) vulnerability in the /getCorsFile endpoint allows attackers to make the server fetch arbitrary URLs on their behalf and return the response, potentially exposing sensitive internal systems, cloud metadata, or private network services. The flaw exists in how request validation is performed—an attacker can bypass whitelist checks by supplying multiple URL parameters that confuse the security filter.
Technical details
The vulnerability is a parameter-confusion SSRF in the /getCorsFile cross-origin proxy endpoint. The TrustHostFilter validates the first non-empty URL parameter in a fixed priority order (checking url before urlPath), comparing it against a whitelist of trusted hosts. However, the controller that performs the actual fetch only reads the urlPath parameter, ignoring the url parameter that was validated. By supplying both url=<whitelisted decoy> and urlPath=<attacker target>, an attacker bypasses validation while the controller fetches the unvalidated target. The response is echoed back to the attacker, enabling SSRF attacks against internal services, cloud metadata endpoints, or local file systems. No authentication is required, and the attack is network-reachable. Patches should align parameter validation with parameter usage.
Affected products
- kkFileView kkFileView >= 4.2.0
Timeline
- 2026-09-16: disclosed: CVE-2026-88592 published