← Database

CVE-2026-129162

MEDIUM CVSS: 5.9 Published: 2026-11-13 Modified: 2026-11-13

Description

Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.

Affected Platforms

Unknown

Weakness Type

CWE-306

References