EUVD-2026-125605

Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/fileId to...

EUVD-2026-125604

Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/fileId link to execute script in the application origin,...

EUVD-2026-125603

Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files witho...

EUVD-2026-125606

Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited...

EUVD-2026-125607

free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subque...

CVE-2026-129160

The Dromara free-fs software (versions 2.0.1 through 2.3.1 ) is vulnerable to an SQL Injection within the FileShareServiceImpl.getPages method. The application passes the orderBy parameter from the /apis/share/pages endpoint directly into a MyBatis-Flex ORDER BY clause without utilizing a column ...

CVE-2026-129161

Dromara free-fs versions 2.0.1 through 2.3.1 are vulnerable to an improper restriction of authentication attempts (CWE-307). An unauthenticated attacker can exploit this by requesting a six-digit password reset code via PUT /apis/user/forget-password for a known email address. Due to the lack of ...

CVE-2026-129162

Dromara free-fs versions 2.0.1 through 2.3.1 contain a missing authentication vulnerability in the FileStreamController.preview component. This flaw allows unauthenticated attackers to download any user's or workspace's stored files by requesting the /api/file/stream/preview/{fileId} endpoint. To...

CVE-2026-129163

The software Dromara free-fs (versions 2.0.1 through 2.3.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw in the file preview endpoint. The issue occurs because the application allows registered users to upload HTML files that are served inline as text/html. An attacker can provide a...

CVE-2026-129164

Dromara free-fs versions 2.0.1 through 2.3.1 are vulnerable to an authorization bypass because share codes are only enforced on the client-side. Attackers who possess a share ID can directly call the share items and download endpoints to list and download files without providing the required code...