{"id":"CVE-2026-95140","published":"2026-10-06T17:17:28.087","lastModified":"2026-10-06T20:17:35.070","description":"kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a \"path\" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/sg-summer/cve/issues/4","tags":[]},{"url":"https://github.com/sg-summer/cve/issues/4","tags":[]}],"exploitRefs":[{"url":"https://github.com/sg-summer/cve/issues/4","tags":[]},{"url":"https://github.com/sg-summer/cve/issues/4","tags":[]}],"hasPoc":true,"ai":{"summary":"The kkFileView application has a directory traversal vulnerability that allows unauthenticated attackers to write files outside the intended upload directory. This means an attacker can potentially place malicious files anywhere on the server filesystem, leading to arbitrary code execution or data compromise.","exploitability":"The vulnerability is relatively easy to exploit as it requires only a crafted multipart request to one of three endpoints (fileUpload, createFolder, existsFile) with a specially crafted path parameter that bypasses validation checks.","blast_radius":"If exploited, this vulnerability could allow attackers to upload malicious files anywhere on the server, potentially leading to complete system compromise through web shell deployment or configuration file manipulation.","remediation":"Upgrade to kkFileView version 5.0.3 or later to address this directory traversal vulnerability.","detection":"Monitor for unusual file creation patterns in the application's upload directory and check for requests with path parameters containing '../' sequences that attempt to traverse above the intended upload root directory.","tags":["directory-traversal","file-upload","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:05:44.972Z"}}