EUVD-2026-125603

Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files witho...

CVE-2026-129164

Dromara free-fs versions 2.0.1 through 2.3.1 are vulnerable to an authorization bypass because share codes are only enforced on the client-side. Attackers who possess a share ID can directly call the share items and download endpoints to list and download files without providing the required code...