Missing Authentication in Dromara Free-fs FileStreamController
CVE-2026-129162

8.2HIGH

Key Information:

Vendor

Dromara

Status
Free-fs
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129162?

Dromara free-fs versions 2.0.1 to 2.3.1 have a vulnerability in the FileStreamController that allows unauthenticated attackers to download files. By obtaining a file ID from shared listings or preview links, attackers can exploit the /api/file/stream/preview/{fileId} endpoint to access any user's or workspace's stored files. This exposure underscores the importance of robust authentication mechanisms to protect sensitive data from unauthorized access.

Affected Version(s)

free-fs 2.0.1 <= 2.3.1

References

https://vul.yulun.ac.cn/20261024/free-fs/
third-party-advisory
https://github.com/dromara/free-fs/issues/28
issue-tracking
https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd...
technical-description

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.