{"id":"CVE-2026-129162","kind":"vulnerability","aliases":["CVE-2026-129162"],"related":[],"title":"Dromara free-fs: missing authentication lets anyone download stored files","description":"Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.","summary":"Dromara free-fs, a Java file storage service, has a flaw in its preview endpoint that skips authentication. An unauthenticated attacker who obtains a file ID can download any user's or workspace's stored files.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-storage","java","package","self-hosted"],"not_affected_if":["network-restricted","version-outside-range"],"how_to_check":"- Check the free-fs version in your build file (for example `pom.xml` or `build.gradle`) against the affected range 2.0.1 through 2.3.1.\n- Look for `/api/file/stream/preview/` in your gateway or access logs.\n- Confirm whether that endpoint answers without a session token.","fix":"- Move to a version after `2.3.1`; the sources do not name the fixed release, so check the vendor's release page.","status":"open","published_at":"2026-11-13T18:17:41+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:28+00:00","updated_at":"2026-11-13T18:51:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T18:51:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version after `2.3.1`; the sources do not name the fixed release, so check the vendor's release page.","reach":"internet","title":"Dromara free-fs: missing authentication lets anyone download stored files","impact":"high","summary":"Dromara free-fs, a Java file storage service, has a flaw in its preview endpoint that skips authentication. An unauthenticated attacker who obtains a file ID can download any user's or workspace's stored files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["java","self-hosted","file-storage"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker downloads any user's or workspace's stored files without credentials","analyst_note":"Find the fixed version and whether the endpoint is exposed by default, from the NVD entry and the VulnCheck advisory.","how_to_check":"- Check the free-fs version in your build file (for example `pom.xml` or `build.gradle`) against the affected range 2.0.1 through 2.3.1.\n- Look for `/api/file/stream/preview/` in your gateway or access logs.\n- Confirm whether that endpoint answers without a session token.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","network-restricted"],"who_is_affected":"Any deployment of free-fs versions 2.0.1 through 2.3.1 that exposes the file preview endpoint to a network where attackers can reach it. Deployments that keep the service behind authentication at the network edge or do not run these versions can skip it. The sources do not say whether the flaw depends on a non-default setting.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4597,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129162':14A,17A '-2026':13A,16A '/api/file/stream/preview':99C '2.0.1':67C '2.3.1':69C 'allow':78C 'anyon':8A 'attack':47B,80C,85C 'authent':6A,44B,73C 'contain':70C 'cve':12A,15A 'download':9A,54B,82C,102C 'dromara':1A,26B,63C 'endpoint':41B 'file':11A,19B,32B,51B,62B,84C,89C,109C 'file-storag':18B 'fileid':100C 'filestreamcontroller.preview':76C 'flaw':37B 'free':3A,28B,65C 'free-f':2A,27B,64C 'fs':4A,29B,66C 'host':25B 'id':52B,90C 'java':21B,31B 'let':7A 'link':96C 'list':93C 'miss':5A,72C 'obtain':49B,87C 'packag':22B 'preview':40B,95C 'request':98C 'self':24B 'self-host':23B 'servic':34B 'share':92C 'skip':43B 'storag':20B,33B 'store':10A,61B,83C 'unauthent':46B,79C 'user':56B,104C 'vulner':74C 'workspac':59B,107C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of free-fs versions 2.0.1 through 2.3.1 that exposes the file preview endpoint to a network where attackers can reach it. Deployments that keep the service behind authentication at the network edge or do not run these versions can skip it. The sources do not say whether the flaw depends on a non-default setting.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filestorage","high","java","package","selfhosted"],"campaign_type":null,"search_a":"'-129162':14A,17A '-2026':13A,16A 'anyon':8A 'authent':6A 'cve':12A,15A 'download':9A 'dromara':1A 'file':11A 'free':3A 'free-f':2A 'fs':4A 'let':7A 'miss':5A 'store':10A","search_b":"'attack':47B 'authent':44B 'download':54B 'dromara':26B 'endpoint':41B 'file':19B,32B,51B,62B 'file-storag':18B 'flaw':37B 'free':28B 'free-f':27B 'fs':29B 'host':25B 'id':52B 'java':21B,31B 'obtain':49B 'packag':22B 'preview':40B 'self':24B 'self-host':23B 'servic':34B 'skip':43B 'storag':20B,33B 'store':61B 'unauthent':46B 'user':56B 'workspac':59B","search_c":"'/api/file/stream/preview':99C '2.0.1':67C '2.3.1':69C 'allow':78C 'attack':80C,85C 'authent':73C 'contain':70C 'download':82C,102C 'dromara':63C 'file':84C,89C,109C 'fileid':100C 'filestreamcontroller.preview':76C 'free':65C 'free-f':64C 'fs':66C 'id':90C 'link':96C 'list':93C 'miss':72C 'obtain':87C 'preview':95C 'request':98C 'share':92C 'store':83C 'unauthent':79C 'user':104C 'vulner':74C 'workspac':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129162","severity":null,"published_at":"2026-11-13T18:17:41+00:00","modified_at":"2026-11-13T18:17:41+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null}],"documents":[{"id":148619,"url":"https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-missing-authentication-via-file-stream-preview","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}