The vulnerability allows an unauthenticated attacker to trigger a Server Side Request Forgery by sending a GET request to the /addTask endpoint. Because the endpoint bypasses the TrustHostFilter and TrustDirFilter, the FileConvertQueueTask can fetch content from arbitrary URLs selected via the fullfilename parameter, which can be coerced into OFFICE, COMPRESS, or CAD types. This flaw is a type‑confusion bypass that can expose internal network resources or sensitive data, and is identified as CWE‑918.

Affected versions are all releases of kkFileView before 5.0.1 from the kekingcn:kkFileView product. The issue has been fixed in version 5.0.1. If you are running any earlier version, the /addTask endpoint is exposed without authentication.

The CVSS base score is 5.8, indicating moderate risk, and the EPSS score is less than 1%, reflecting a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can reach the vulnerable endpoint over the network without credentials, making the bug straightforward to exploit, but the low EPSS suggests that active exploitation remains rare.