CVE-2026-73244

kkFileView (Spring Boot-based) prior to version 5.0.1 suffers an unauthenticated path traversal: the POST /listFiles endpoint forwards a user-controlled path param from FileController.getFiles to Files.newDirectoryStream without constraining to the demo directory, enabling directory enumeration o...