EUVD-2026-81259

kkFileView = 4.2.0 is vulnerable to Server-Side Request Forgery SSRF. The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: t...

CVE-2026-88592

kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF) in the cross-origin file proxy endpoint /getCorsFile. The root cause is a parameter mismatch between the TrustHostFilter and the controller: the filter validates the first non-empty parameter in a fixed priority order, whi...