CVE-2026-95140

Summary

The kkFileView application has a directory traversal vulnerability that allows unauthenticated attackers to write files outside the intended upload directory. This means an attacker can potentially place malicious files anywhere on the server filesystem, leading to arbitrary code execution or data compromise.

Exploitability

The vulnerability is relatively easy to exploit as it requires only a crafted multipart request to one of three endpoints (fileUpload, createFolder, existsFile) with a specially crafted path parameter that bypasses validation checks.

Blast radius

If exploited, this vulnerability could allow attackers to upload malicious files anywhere on the server, potentially leading to complete system compromise through web shell deployment or configuration file manipulation.

Detection

Monitor for unusual file creation patterns in the application's upload directory and check for requests with path parameters containing '../' sequences that attempt to traverse above the intended upload root directory.

Prioritized remediation

Upgrade to kkFileView version 5.0.3 or later to address this directory traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.