CVE-2026-88592

The software kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF) via the cross-origin file proxy endpoint /getCorsFile. The root cause is a validation discrepancy: the TrustHostFilter validates the first non-empty parameter in a fixed priority order, but the controller spec...

CVE-2026-88592

kkFileView = 4.2.0 is vulnerable to Server-Side Request Forgery SSRF. The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: t...