{"id":"CVE-2026-88592","aliases":["EUVD-2026-81259","GHSA-xm5x-697f-2q56"],"status":"published","title":"kkFileView \u003e= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file...","description":"kkFileView \u003e= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: the filter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath. By supplying both urlPath=\u003creal target\u003e and url=\u003cwhitelisted decoy address\u003e in the same request, the decoy passes validation while the unvalidated real target is fetched server-side — and the response body is echoed back to the attacker.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00211,"percentile":0.11434,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345"],"published":"2026-09-16T00:00:00Z","modified":"2026-09-22T20:00:03Z","references":[{"url":"https://github.com/sg-summer/cve/issues/2","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88592"},{"url":"https://github.com/advisories/GHSA-xm5x-697f-2q56"}],"sources":{"cve":[{"id":"CVE-2026-88592","description":"kkFileView \u003e= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: the filter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath. By supplying both urlPath=\u003creal target\u003e and url=\u003cwhitelisted decoy address\u003e in the same request, the decoy passes validation while the unvalidated real target is fetched server-side — and the response body is echoed back to the attacker.","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-09-17T19:35:16.921Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T13:42:04.39372Z"}],"euvd":[{"id":"EUVD-2026-81259","description":"kkFileView \u003e= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: the filter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath. By supplying both urlPath=\u003creal target\u003e and url=\u003cwhitelisted decoy address\u003e in the same request, the decoy passes validation while the unvalidated real target is fetched server-side — and the response body is echoed back to the attacker.","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-09-17T19:35:16Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:28:09.684322Z"}],"ghsa":[{"id":"GHSA-xm5x-697f-2q56","title":"kkFileView \u003e= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file...","description":"kkFileView \u003e= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: the filter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath. By supplying both urlPath=\u003creal target\u003e and url=\u003cwhitelisted decoy address\u003e in the same request, the decoy passes validation while the unvalidated real target is fetched server-side — and the response body is echoed back to the attacker.","status":"published","published":"2026-09-16T21:32:47Z","modified":"2026-09-17T21:32:42Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:12:08.779152Z"}],"nvd":[{"id":"CVE-2026-88592","description":"kkFileView \u003e= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: the filter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath. By supplying both urlPath=\u003creal target\u003e and url=\u003cwhitelisted decoy address\u003e in the same request, the decoy passes validation while the unvalidated real target is fetched server-side — and the response body is echoed back to the attacker.","status":"published","published":"2026-09-16T20:17:38.453Z","modified":"2026-09-22T20:00:03.713Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:12:49.013904Z"}]}}