CVE-2026-129162 · Package
NO FIX YET · SEE WHAT TO DO
Dromara free-fs, a Java file storage service, has a flaw in its preview endpoint that skips authentication. An unauthenticated attacker who obtains a file ID can download any user's or workspace's stored files.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any deployment of free-fs versions 2.0.1 through 2.3.1 that exposes the file preview endpoint to a network where attackers can reach it. Deployments that keep the service behind authentication at the network edge or do not run these versions can skip it. The sources do not say whether the flaw depends on a non-default setting.
Not affected if network-restricted, version-outside-range
Who cares file-storage, java, self-hosted
pom.xml or build.gradle) against the affected range 2.0.1 through 2.3.1./api/file/stream/preview/ in your gateway or access logs.2.3.1; the sources do not name the fixed release, so check the vendor's release page.Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.