SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111646 · Microsoft / collected KEV context

cve-program · CVE-2026-111646

• https://hackmd.io/@hieuPenguinnn/surveyking-public-preview-unauth-file-read
• https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/api/src/main/java/cn/surveyking/server/api/SurveyApi.java#L99-L107
• https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/rdbms/src/main/java/cn/surveyking/server/impl/FileServiceImpl.java#L197-L228
• https://github.com/javahuang/SurveyKing/commit/9489171d53e55ace2856a91af38034665c0064a4
• https://github.com/javahuang/SurveyKing
• https://www.vulncheck.com/advisories/surveyking-before-1.13.0-unauthenticated-file-download-via-api-public-preview

No related operational record is retained in the current change model.