kkFileView is a Spring Boot-based universal file online preview project. In versions before 5.0.1, the POST /listFiles endpoint in FileController.java does not properly confine the user-controlled path parameter when passed to Files.newDirectoryStream. This lack of confinement allows directory enumeration outside the intended demo directory, constituting a CWE-22 path traversal vulnerability. The vulnerability is unauthenticated and has a CVSS 3.1 base score of 5.3, indicating medium severity. The issue is resolved in version 5.0.1.

An unauthenticated attacker can enumerate directories outside the intended root directory, potentially exposing sensitive file system information. The vulnerability does not allow modification or deletion of files (no integrity or availability impact), but it leaks directory structure information (confidentiality impact).

Upgrade kkFileView to version 5.0.1 or later, where this path traversal vulnerability is fixed by properly restricting the user-controlled path parameter to the intended directory. Patch status is not explicitly confirmed in vendor advisories, but the description states the issue is fixed in 5.0.1. Until upgrade, restrict access to the vulnerable endpoint or implement additional access controls if possible.