Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-129164

Dromara free-fs 2.0.1 through 2.3.1 Share Code and Permission Scope Bypass

Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files without the code, even on preview-only shares.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Free-fs
CVE-2026-129163

Dromara free-fs 2.0.1 through 2.3.1 Stored XSS via File Preview Endpoint

Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Free-fs
CVE-2026-129162

Dromara free-fs 2.0.1 through 2.3.1 Missing Authentication via File Stream Preview

Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Free-fs
CVE-2026-129161

Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover

Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Free-fs
CVE-2026-129160

Dromara free-fs 2.0.1 through 2.3.1 SQL Injection via orderBy Parameter

free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Free-fs