EUVD-2026-125607

free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subque...

CVE-2026-129160

The Dromara free-fs software (versions 2.0.1 through 2.3.1 ) is vulnerable to an SQL Injection within the FileShareServiceImpl.getPages method. The application passes the orderBy parameter from the /apis/share/pages endpoint directly into a MyBatis-Flex ORDER BY clause without utilizing a column ...