kkFileView versions 5.0.0 through 5.0.2 expose a directory traversal flaw in FileController.java where the "path" parameter is concatenated into the upload base path without validation. An unauthenticated attacker can send a crafted multipart request containing traversal sequences to create directories and write files outside the intended fileDir root. This allows the attacker to place or modify arbitrary files within the server’s filesystem, potentially compromising data integrity or exposing sensitive information.

Affected systems are installations of the open‑source web file uploader kkFileView with versions 5.0.0 to 5.0.2. Any deployment exposing the fileUpload, createFolder, or existsFile endpoints is susceptible, regardless of other configuration details.

The flaw can be exploited without authentication, giving the attacker the ability to write to arbitrary paths. The CVSS score of 7.5 reflects a high severity, while no EPSS score or KEV listing indicates limited publicly known exploitation data at this time. Nonetheless, the lack of input validation and authentication means the risk remains significant for exposed services.