CVE-2026-129160

The Dromara free-fs software (versions 2.0.1 through 2.3.1 ) is vulnerable to an SQL Injection within the FileShareServiceImpl.getPages method. The application passes the orderBy parameter from the /apis/share/pages endpoint directly into a MyBatis-Flex ORDER BY clause without utilizing a column ...