CVE-2026-88593

Published: Set 16, 2026 Last Modified: Set 16, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.

https://github.com/sg-summer/cve/issues/3
https://github.com/sg-summer/cve/issues/3