CVE-2026-88592 Details

A Server-Side Request Forgery (SSRF) vulnerability has been identified in kkFileView versions 4.2.0 and later, including the latest master. The issue resides in the cross-origin file proxy endpoint '/getCorsFile', which is enabled by default and intended for use with pdf.js previews. The endpoint is protected by a TrustHostFilter that validates the 'url' parameter against a whitelist. However, the validation process is flawed: the filter checks the first non-empty parameter in a fixed order, while the controller only retrieves the 'urlPath' parameter. This discrepancy allows an attacker to send a request with both 'urlPath' (pointing to a real target) and 'url' (a whitelisted decoy), bypassing the validation and fetching the untrusted resource server-side. The response is then echoed back to the attacker, creating a non-blind SSRF vulnerability that could be exploited to access internal services or probe intranet topology.

Users are advised to disable the cross-origin proxy endpoint by setting 'kk.Getcorsfile = false' in the 'config/application.properties' file. If the endpoint cannot be disabled, a reverse-proxy or WAF virtual patch can be applied to reject any requests containing 'url' or 'currentUrl' parameters. Alternatively, a code-level hotfix can be implemented to force the TrustHostFilter to validate the 'urlPath' parameter for '/getCorsFile' requests.