Is CVE-2026-73244 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73244?

CVE-2026-73244 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-73244

Description

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileController#getFiles to Files.newDirectoryStream without confinement to the demo directory, allowing directory enumeration outside the intended root. This issue is fixed in version 5.0.1.