CVE-2023-48815

kkFileView 4.3.0 has an incorrect access-control issue classified as an open redirect: the application can be induced to bounce a user to an attacker-chosen destination. There's no code execution and no direct data theft here — the flaw is that a trusted kkFileView URL becomes a springboard to somewhere hostile, lending an attacker's link the credibility of a legitimate host.

Open redirects are low-severity on their own, and the 6.1 with required user interaction reflects that honestly. Their value to attackers is as a component: they make phishing links more convincing by opening on a domain the target trusts before forwarding to a credential-harvesting page, and they can grease OAuth or SSO abuse flows. The harm is realized only when a user follows a crafted link and then acts on what they land on.

We rank this as a chaining and phishing-hygiene concern rather than a standalone risk. Where kkFileView is exposed we note it as redirect infrastructure a phishing campaign could borrow, and lean on user-facing awareness plus detection of outbound redirect abuse. It stays well below the code-execution items in this batch; the sensible resolution is updating the component so it stops honoring untrusted redirect targets.