CVE-2026-88593

Vulnerability Description

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.

References

https://github.com/sg-summer/cve/issues/3

FAQ

What is CVE-2026-88593?

CVE-2026-88593 is a documented vulnerability. kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates ...

How severe is CVE-2026-88593?

CVSS scoring is not yet available for CVE-2026-88593. Check NVD for updates.

Is there a patch for CVE-2026-88593?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.