CVE-2026-73243

The CVSS 5.8 rating for CVE-2026-73243 is misleading. This isn't a standard Server-Side Request Forgery — it's a TrustHostFilter and TrustDirFilter bypass on an unauthenticated endpoint of kkFileView, a file preview service architecturally designed to fetch external URLs. That's a critical distinction: you're not exploiting a feature to do something unintended; you're bypassing the guardrails specifically limiting which URLs the legitimate feature can access. The queue-based execution model compounds the risk significantly. The initial /addTask request triggers an asynchronous task through FileConvertQueueTask that executes later, in a different context. This temporal separation means detection based on synchronous request-response patterns will miss it entirely. An attacker can probe internal network ranges through sequential requests, map internal service topologies, or exfiltrate data through repeated small fetches — all with timing scattered across the queue processing window and hidden beneath legitimate document processing activity. What makes this particularly dangerous is kkFileView's position in enterprise architectures. Document preview services sit at the intersection of multiple trust domains — they have credentials for internal authentication systems, access to file storage, and sit adjacent to collaboration infrastructure. The service processes content through dozens of format handlers (CAD, Office, images, archives), each representing a code path that receives external content. An attacker controlling both the URL and the response content is feeding crafted data to format parsers that may have unpatched vulnerabilities. The attack surface isn't just 'can we make the service fetch our URL' — it's 'what happens to whatever we send back through a format handler that hasn't been audited recently?' Check whether other unauthenticated endpoints in kkFileView are similarly omitted from TrustHostFilter or TrustDirFilter, which would indicate a systemic rather than isolated oversight. Examine your deployment's network posture — if kkFileView runs in the DMZ or with internal network access, treat this as a lateral movement platform, not a medium-severity web bug. Verify whether version 5.0.1's fix restructures the filter to be opt-out rather than opt-in, or just gates the /addTask path specifically.

Reviewed through automated stages and approved by a human before publication.