Executive brief
kkFileView is an open-source online document preview service widely deployed in enterprise and government networks. The /onlinePreview endpoint contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code through unsanitized URL parameters. When a user clicks a crafted preview link, the injected script executes in their browser with access to session cookies and can read trusted resources, enabling account takeover and data theft.
Technical details
The vulnerability is a reflected XSS (CWE-79) in the OnlinePreviewController class. User-controlled `page` and `kkagent` request parameters are passed directly to FreeMarker templates via model.addAttribute() without sanitization and inserted into raw JavaScript contexts (e.g., `var kkagent = '${kkagent}';`). The attack vector is network-based and requires no authentication; a victim must click a malicious link. An attacker can execute arbitrary JavaScript in the kkFileView origin, steal session cookies, spoof page content, and exploit the same-origin proxy /getCorsFile to read sensitive resources. The root cause is an implementation oversight—the codebase already sanitizes a similar parameter (highlightall) using KkFileUtils.htmlEscape(), but the new page and kkagent parameters were not subjected to the same escaping. Patches should apply htmlEscape() to both parameters or use FreeMarker's ?js_string filter.
Affected products
- kkFileView kkFileView 5.0.0 through 5.0.2
Timeline
- 2026-09-01: disclosed: Vulnerability reported on GitHub
- 2026-09-16: advisory: Published to NVD as CVE-2026-88593