CVE-2026-73244

Name of the Vulnerable Software and Affected Versions kkFileView versions prior to 5.0.1

Description The unauthenticated POST '/listFiles' endpoint passes a user-controlled path parameter from the getFiles() function to Files.newDirectoryStream without restricting it to the demo directory. This allows directory enumeration outside the intended root directory.

Recommendations Update to version 5.0.1. Restrict access to the '/listFiles' endpoint to minimize the risk of exploitation.