CVE-2026-95140: n/a

A directory traversal vulnerability exists in kkFileView versions 5.0.0, 5.0.1, and 5.0.2 within FileController.java. The vulnerability arises because the "path" parameter accepted by the fileUpload, createFolder, and existsFile endpoints is concatenated directly into the upload base path without proper validation. This allows unauthenticated attackers to craft multipart requests that create arbitrary directories and write files outside the designated fileDir root, potentially leading to unauthorized file system access and modification.

Unauthenticated attackers can exploit this vulnerability to create directories and write arbitrary files outside the intended upload directory. This may lead to unauthorized file system modifications, potentially enabling further attacks or disruption of service depending on the environment and usage of kkFileView.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and validate or sanitize the "path" parameter to prevent directory traversal. Monitor for suspicious multipart requests targeting these endpoints.