Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-88593 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CNA: CISA-ADPCVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/sg-summer/cve/issues/3	CISA-ADP	ExploitIssue TrackingRemedyTechnical Analysis
https://github.com/sg-summer/cve/issues/3	[email protected]	ExploitIssue TrackingRemedyTechnical Analysis

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	CISA-ADP

Affected Products

Product	Versions
kkFileView	>= 5.0.0, <= 5.0.2 (semver)
CPE cpe:2.3:a:keking:kkfileview:::::::: Remediation Mitigation:low effort Implement a reverse proxy or WAF rule to reject 'page' and 'kkagent' values containing metacharacters such as '\u0027, ';\u0027, and <. Legitimate frontends only send integer page numbers and 'true/false', so this rule should cause no false positives. Example Nginx configuration: location /onlinePreview { if ($arg_page ~ ["';<>]) { return 403; } if ($arg_kkagent ~ ["';<>]) { return 403; } proxy_pass ...; } Hotfix:moderate effort Modify the OnlinePreviewController to sanitize the 'page' and 'kkagent' parameters using KkFileUtils.htmlEscape(), similar to the existing 'highlightall' handling. Patch:moderate effort Append '?js_string' to all string interpolations in the affected templates: 'var page = '${page?js_string}';' and 'var kkagent = '${kkagent?js_string}'; The affected templates are: - officePicture.ftl - txt.ftl - tiff.ftl - eml.ftl - ofd.ftl - msg.ftl - xmind.ftl - epub.ftl - dcm.ftl - heic.ftl

Product

Versions

kkFileView

>= 5.0.0, <= 5.0.2 (semver)

CPE

cpe:2.3:a:keking:kkfileview:*:*:*:*:*:*:*:*

Remediation

Mitigation:low effort
Implement a reverse proxy or WAF rule to reject 'page' and 'kkagent' values containing metacharacters such as '\u0027, ';\u0027, and <. Legitimate frontends only send integer page numbers and 'true/false', so this rule should cause no false positives. Example Nginx configuration: location /onlinePreview { if ($arg_page ~ ["';<>]) { return 403; } if ($arg_kkagent ~ ["';<>]) { return 403; } proxy_pass ...; }
Hotfix:moderate effort
Modify the OnlinePreviewController to sanitize the 'page' and 'kkagent' parameters using KkFileUtils.htmlEscape(), similar to the existing 'highlightall' handling.
Patch:moderate effort
Append '?js_string' to all string interpolations in the affected templates: 'var page = '${page?js_string}';' and 'var kkagent = '${kkagent?js_string}'; The affected templates are: - officePicture.ftl - txt.ftl - tiff.ftl - eml.ftl - ofd.ftl - msg.ftl - xmind.ftl - epub.ftl - dcm.ftl - heic.ftl

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 22, 2026	CVE Modified	CISA-ADP
Sep 16, 2026	New CVE Received	[email protected]