CVE-2022-43140: Keking Kkfileview

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.

Affected products

• Keking Kkfileview: version 4.1.0 only

Published 2022-11-17. Last modified 2026-06-17.