CVE-2026-129160 · Package
NO FIX YET · SEE WHAT TO DO
free-fs versions 2.0.1 through 2.3.1 pass an orderBy parameter from the /apis/share/pages endpoint straight into an SQL ORDER BY clause without a column allowlist. An authenticated user can use crafted CASE WHEN subqueries as a boolean oracle to read arbitrary database contents, such as share codes.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments of free-fs in versions 2.0.1 through 2.3.1 that expose the /apis/share/pages endpoint are exposed. The attacker needs an authenticated account, and the flaw is in the orderBy handling of the share listing. Instances without accounts or running other versions are not covered by the sources.
Not affected if unknown
Who cares free-fs, java, mybatis-flex, self-hosted
/apis/share/pages endpoint and its orderBy parameter in the running application's routesfree-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.