CVE-2026-129162

Dromara free-fs versions 2.0.1 through 2.3.1 contain a missing authentication vulnerability in the FileStreamController.preview component. This flaw allows unauthenticated attackers to download any user's or workspace's stored files by requesting the /api/file/stream/preview/{fileId} endpoint. To...