kkFileView, a Spring Boot based file preview application, allows an unauthenticated attacker to send a POST request to the /listFiles endpoint and supply a user-controlled path parameter. The application forwards this path directly to the Files.newDirectoryStream call without constraining it to the intended demo directory, enabling enumeration of files and directories outside the permitted root. The result is exposure of file listings that could reveal sensitive configuration files, user data, or other assets, constituting a directory disclosure vulnerability. The weakness is a classic path traversal flaw catalogued as CWE-22.

The affected vendor is kekingcn, providing the product kkFileView. Any release before version 5.0.1 is vulnerable; patching to 5.0.1 or later removes the flaw.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not currently listed in CISA's KEV catalog, implying it is not a known exploited issue in the wild. Attacks can be launched from any network location without authentication, but the impact is limited to enumeration rather than complete system compromise. The attack vector is straightforward: submit a crafted POST request to /listFiles with a malicious path; the server will list directory contents outside the intended boundary.