{"id":"CVE-2026-129160","kind":"vulnerability","aliases":["CVE-2026-129160"],"related":[],"title":"free-fs: SQL injection in share listing lets signed-in users read database","description":"free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.","summary":"free-fs versions 2.0.1 through 2.3.1 pass an orderBy parameter from the /apis/share/pages endpoint straight into an SQL ORDER BY clause without a column allowlist. An authenticated user can use crafted CASE WHEN subqueries as a boolean oracle to read arbitrary database contents, such as share codes.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["free-fs","java","mybatis-flex","package","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the free-fs version in the deployed project's package or build metadata: unknown whether it is in the 2.0.1 to 2.3.1 range without the project's own manifest\n- Look for the `/apis/share/pages` endpoint and its `orderBy` parameter in the running application's routes","fix":"- free-fs: unknown, the sources do not state a fixed version","status":"open","published_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:32+00:00","updated_at":"2026-11-13T18:51:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T18:51:32Z","model":"claude-haiku-5-5","output":{"fix":"- free-fs: unknown, the sources do not state a fixed version","reach":"internet","title":"free-fs: SQL injection in share listing lets signed-in users read database","impact":"medium","summary":"free-fs versions 2.0.1 through 2.3.1 pass an orderBy parameter from the /apis/share/pages endpoint straight into an SQL ORDER BY clause without a column allowlist. An authenticated user can use crafted CASE WHEN subqueries as a boolean oracle to read arbitrary database contents, such as share codes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["free-fs","java","mybatis-flex","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated users read arbitrary database contents, including share codes","analyst_note":"Confirm the fixed version and any mitigation from the NVD and VulnCheck pages; sources do not name a fixed release.","how_to_check":"- Check the free-fs version in the deployed project's package or build metadata: unknown whether it is in the 2.0.1 to 2.3.1 range without the project's own manifest\n- Look for the `/apis/share/pages` endpoint and its `orderBy` parameter in the running application's routes\n- unknown for further checks, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Deployments of free-fs in versions 2.0.1 through 2.3.1 that expose the /apis/share/pages endpoint are exposed. The attacker needs an authenticated account, and the flaw is in the orderBy handling of the share listing. Instances without accounts or running other versions are not covered by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000787,"input_tokens":4646,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129160':18A,21A '-2026':17A,20A '/apis/share/pages':46B,101C '2.0.1':37B,84C '2.3.1':39B,86C 'allowlist':58B 'arbitrari':74B,135C 'authent':60B,117C 'boolean':70B,131C 'case':65B,121C 'claus':54B,108C 'code':80B,141C 'column':57B,115C 'contain':87C 'content':76B,137C 'craft':64B 'cve':16A,19A 'databas':15A,75B,136C 'endpoint':47B,102C 'express':124C 'fileshareserviceimpl.getpages':93C 'flex':28B,112C 'free':2A,23B,34B,82C 'free-f':1A,22B,33B,81C 'fs':3A,24B,35B,83C 'host':32B 'inject':5A,90C 'java':25B 'let':9A 'list':8A 'mybati':27B,111C 'mybatis-flex':26B,110C 'oracl':71B,132C 'order':52B,106C,128C 'orderbi':42B,97C 'packag':29B 'paramet':43B,98C 'pass':40B,95C 'read':14A,73B,134C 'self':31B 'self-host':30B 'share':7A,79B,127C,140C 'sign':11A 'signed-in':10A 'sql':4A,51B,89C 'straight':48B 'subqueri':67B,123C 'suppli':120C 'use':63B,126C 'user':13A,61B,118C 'verbatim':103C 'version':36B 'via':109C 'vulner':91C 'whitelist':116C 'without':55B,113C","nicknames":[],"mitigations":[],"who_affected":"Deployments of free-fs in versions 2.0.1 through 2.3.1 that expose the /apis/share/pages endpoint are exposed. The attacker needs an authenticated account, and the flaw is in the orderBy handling of the share listing. Instances without accounts or running other versions are not covered by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freefs","high","java","mybatisflex","package","selfhosted"],"campaign_type":null,"search_a":"'-129160':18A,21A '-2026':17A,20A 'cve':16A,19A 'databas':15A 'free':2A 'free-f':1A 'fs':3A 'inject':5A 'let':9A 'list':8A 'read':14A 'share':7A 'sign':11A 'signed-in':10A 'sql':4A 'user':13A","search_b":"'/apis/share/pages':46B '2.0.1':37B '2.3.1':39B 'allowlist':58B 'arbitrari':74B 'authent':60B 'boolean':70B 'case':65B 'claus':54B 'code':80B 'column':57B 'content':76B 'craft':64B 'databas':75B 'endpoint':47B 'flex':28B 'free':23B,34B 'free-f':22B,33B 'fs':24B,35B 'host':32B 'java':25B 'mybati':27B 'mybatis-flex':26B 'oracl':71B 'order':52B 'orderbi':42B 'packag':29B 'paramet':43B 'pass':40B 'read':73B 'self':31B 'self-host':30B 'share':79B 'sql':51B 'straight':48B 'subqueri':67B 'use':63B 'user':61B 'version':36B 'without':55B","search_c":"'/apis/share/pages':101C '2.0.1':84C '2.3.1':86C 'arbitrari':135C 'authent':117C 'boolean':131C 'case':121C 'claus':108C 'code':141C 'column':115C 'contain':87C 'content':137C 'databas':136C 'endpoint':102C 'express':124C 'fileshareserviceimpl.getpages':93C 'flex':112C 'free':82C 'free-f':81C 'fs':83C 'inject':90C 'mybati':111C 'mybatis-flex':110C 'oracl':132C 'order':106C,128C 'orderbi':97C 'paramet':98C 'pass':95C 'read':134C 'share':127C,140C 'sql':89C 'subqueri':123C 'suppli':120C 'use':126C 'user':118C 'verbatim':103C 'via':109C 'vulner':91C 'whitelist':116C 'without':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129160","severity":null,"published_at":"2026-11-13T18:17:40+00:00","modified_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null}],"documents":[{"id":148617,"url":"https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-sql-injection-via-orderby-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}