CVE-2026-88592

kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF) in the cross-origin file proxy endpoint /getCorsFile. The root cause is a parameter mismatch between the TrustHostFilter and the controller: the filter validates the first non-empty parameter in a fixed priority order, whi...