CVE-2026-124556 · Package
NO FIX YET
kkFileView, a Java file preview server, trusts the X-Base-Url request header when building base URLs in BaseUrlFilter.getBaseUrl. An attacker can make the server redirect users to an arbitrary external site, which supports phishing.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running kkFileView up to 5.0.3 that expose it to users or networks where a redirect could be used for phishing. The flaw is in the server's base URL filter, so it applies to any deployment that reads X-Base-Url from incoming requests. Deployments behind a proxy that strips or overwrites this header are less exposed, but the sources do not say how common that is.
Not affected if header-stripped-at-proxy
Who cares java, kkfileview, self-hosted
5.0.3; versions up to and including 5.0.3 are reported as affected.BaseUrlFilter.java under server/src/main/java/cn/keking/web/filter/ in the source or build to confirm the code path is present.X-Base-Url header set to an external host and see whether redirect responses point there.No fix yet, per the sources.
A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.