Threats affecting pkg:github/kekingcn/kkFileView

CVE-2026-124556 is an open redirect vulnerability in kekingcn kkFileView versions 5.0.0 through 5.0.3. The flaw exists in the BaseUrlFilter.getBaseUrl function, where manipulation of the X-Base-Url argument allows an attacker to redirect users to arbitrary external URLs. The vulnerability can be exploited remotely and requires user interaction. Public exploit code has been disclosed, but no vendor response or patch is currently available.

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.