{"id":"CVE-2026-124556","kind":"vulnerability","aliases":["CVE-2026-124556"],"related":[],"title":"kkFileView: X-Base-Url header enables open redirect to attacker sites","description":"A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"kkFileView, a Java file preview server, trusts the X-Base-Url request header when building base URLs in BaseUrlFilter.getBaseUrl. An attacker can make the server redirect users to an arbitrary external site, which supports phishing.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","kkfileview","package","self-hosted"],"not_affected_if":["header-stripped-at-proxy"],"how_to_check":"- Check the deployed kkFileView version against `5.0.3`; versions up to and including `5.0.3` are reported as affected.\n- Look for `BaseUrlFilter.java` under `server/src/main/java/cn/keking/web/filter/` in the source or build to confirm the code path is present.\n- Send a request with an `X-Base-Url` header set to an external host and see whether redirect responses point there.","fix":null,"status":"open","published_at":"2026-11-09T03:16:37+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","triaged_at":"2026-11-09T03:26:28+00:00","updated_at":"2026-11-09T03:26:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T03:26:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"kkFileView: X-Base-Url header enables open redirect to attacker sites","impact":"low","summary":"kkFileView, a Java file preview server, trusts the X-Base-Url request header when building base URLs in BaseUrlFilter.getBaseUrl. An attacker can make the server redirect users to an arbitrary external site, which supports phishing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kkfileview","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"users are redirected to attacker-chosen external sites","analyst_note":"Confirm the fixed version and vendor response from the linked vendor advisory; the sources say the vendor did not respond to early disclosure.","how_to_check":"- Check the deployed kkFileView version against `5.0.3`; versions up to and including `5.0.3` are reported as affected.\n- Look for `BaseUrlFilter.java` under `server/src/main/java/cn/keking/web/filter/` in the source or build to confirm the code path is present.\n- Send a request with an `X-Base-Url` header set to an external host and see whether redirect responses point there.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["header-stripped-at-proxy"],"who_is_affected":"Teams running kkFileView up to 5.0.3 that expose it to users or networks where a redirect could be used for phishing. The flaw is in the server's base URL filter, so it applies to any deployment that reads X-Base-Url from incoming requests. Deployments behind a proxy that strips or overwrites this header are less exposed, but the sources do not say how common that is.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000787,"input_tokens":4631,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124556':15A,18A '-2026':14A,17A '5.0.3':72C 'affect':75C 'arbitrari':55B 'argument':87C 'attack':11A,46B,97C 'base':4A,35B,41B,90C 'baseurlfilter.getbaseurl':44B,78C 'build':40B 'carri':102C 'contact':118C 'cve':13A,16A 'detect':66C 'disclos':109C 'disclosur':122C 'earli':119C 'enabl':7A 'exploit':106C 'extern':56B 'file':28B,81C 'function':77C 'header':6A,38B 'host':24B 'issu':74C 'java':19B,27B 'kekingcn':68C 'kkfileview':1A,20B,25B,69C 'lead':92C 'make':48B 'manipul':84C 'may':112C 'open':8A,94C 'packag':21B 'phish':60B 'possibl':99C 'preview':29B 'public':110C 'redirect':9A,51B,95C 'remot':104C 'request':37B 'respond':126C 'secur':62C 'self':23B 'self-host':22B 'server':30B,50B 'server/src/main/java/cn/keking/web/filter/baseurlfilter.java':82C 'site':12A,57B 'support':59B 'trust':31B 'url':5A,36B,42B,91C 'use':114C 'user':52B 'vendor':116C 'vulner':63C 'way':129C 'x':3A,34B,89C 'x-base-url':2A,33B,88C","nicknames":[],"mitigations":[],"who_affected":"Teams running kkFileView up to 5.0.3 that expose it to users or networks where a redirect could be used for phishing. The flaw is in the server's base URL filter, so it applies to any deployment that reads X-Base-Url from incoming requests. Deployments behind a proxy that strips or overwrites this header are less exposed, but the sources do not say how common that is.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","kkfileview","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124556':15A,18A '-2026':14A,17A 'attack':11A 'base':4A 'cve':13A,16A 'enabl':7A 'header':6A 'kkfileview':1A 'open':8A 'redirect':9A 'site':12A 'url':5A 'x':3A 'x-base-url':2A","search_b":"'arbitrari':55B 'attack':46B 'base':35B,41B 'baseurlfilter.getbaseurl':44B 'build':40B 'extern':56B 'file':28B 'header':38B 'host':24B 'java':19B,27B 'kkfileview':20B,25B 'make':48B 'packag':21B 'phish':60B 'preview':29B 'redirect':51B 'request':37B 'self':23B 'self-host':22B 'server':30B,50B 'site':57B 'support':59B 'trust':31B 'url':36B,42B 'user':52B 'x':34B 'x-base-url':33B","search_c":"'5.0.3':72C 'affect':75C 'argument':87C 'attack':97C 'base':90C 'baseurlfilter.getbaseurl':78C 'carri':102C 'contact':118C 'detect':66C 'disclos':109C 'disclosur':122C 'earli':119C 'exploit':106C 'file':81C 'function':77C 'issu':74C 'kekingcn':68C 'kkfileview':69C 'lead':92C 'manipul':84C 'may':112C 'open':94C 'possibl':99C 'public':110C 'redirect':95C 'remot':104C 'respond':126C 'secur':62C 'server/src/main/java/cn/keking/web/filter/baseurlfilter.java':82C 'url':91C 'use':114C 'vendor':116C 'vulner':63C 'way':129C 'x':89C 'x-base-url':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T03:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124556","severity":null,"published_at":"2026-11-09T03:16:37+00:00","modified_at":"2026-11-09T03:16:37+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","fetched_at":"2026-11-09T03:24:19+00:00","note":null}],"documents":[{"id":105426,"url":"https://github.com/kekingcn/kkFileView/security/advisories/GHSA-wrm9-r4fj-f8q5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}