---
id: "CVE-2026-129162"
page: "https://infrastack.ai/live/CVE-2026-129162"
kind: "vulnerability"
aliases: ["CVE-2026-129162"]
title: "Dromara free-fs: missing authentication lets anyone download stored files"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["file-storage", "java", "package", "self-hosted"]
not_affected_if: ["network-restricted", "version-outside-range"]
published_at: "2026-11-13T18:17:41+00:00"
first_seen_at: "2026-11-13T18:49:30+00:00"
updated_at: "2026-11-13T18:51:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129162", "first_seen_at": "2026-11-13T18:49:30+00:00"}]
exploit_sources: []
---

# Dromara free-fs: missing authentication lets anyone download stored files

Link for people: https://infrastack.ai/live/CVE-2026-129162 (this .md is for agents)

Dromara free-fs, a Java file storage service, has a flaw in its preview endpoint that skips authentication. An unauthenticated attacker who obtains a file ID can download any user's or workspace's stored files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the free-fs version in your build file (for example `pom.xml` or `build.gradle`) against the affected range 2.0.1 through 2.3.1.
- Look for `/api/file/stream/preview/` in your gateway or access logs.
- Confirm whether that endpoint answers without a session token.

## Fix

- Move to a version after `2.3.1`; the sources do not name the fixed release, so check the vendor's release page.

## Timeline

- 2026-11-13T18:49:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129162

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-missing-authentication-via-file-stream-preview

## From the sources

Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_