The vulnerability in kkFileView >= 4.2.0 involves the /getCorsFile endpoint, which is intended to proxy files cross-origin and is protected by a TrustHostFilter that validates URLs against a whitelist. However, the filter validates the first non-empty parameter in a fixed priority order, while the controller fetches only the urlPath parameter. An attacker can supply both urlPath=<real target> and url=<whitelisted decoy> in the same request, causing the filter to validate the decoy URL but the server to fetch the unvalidated real target URL. This results in a Server-Side Request Forgery (SSRF) vulnerability where the server fetches arbitrary URLs and returns their content to the attacker.

An attacker can exploit this SSRF vulnerability to make the server perform unauthorized requests to internal or external resources, potentially accessing sensitive information or interacting with internal services that are not otherwise accessible. The server's response body is returned to the attacker, which may lead to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the vulnerable endpoint to untrusted users or implement additional access controls and input validation to ensure that only trusted URLs are fetched.