CVE-2026-129162

Dromara free-fs versions 2.0.1 through 2.3.1 contain a missing authentication vulnerability in the FileStreamController.preview component. This flaw allows unauthenticated attackers to download any user's or workspace's stored files by requesting the /api/file/stream/preview/{fileId} endpoint. To...

EUVD-2026-125605

Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/fileId to...