CVE-2026-129163 · Package
NO FIX YET
Dromara free-fs versions 2.0.1 through 2.3.1 serve uploaded HTML files inline as text/html, so a registered user can plant a file that runs script. A victim who opens the preview link runs that script in the application's origin, which can call the /apis endpoints to read the victim's files and account.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments of free-fs in the 2.0.1 to 2.3.1 range where registered users can upload files and other users can open previews. The sources do not say whether a default configuration is affected or whether private deployments are exempt. Teams that run a version outside that range can skip it.
Not affected if version-outside-2.0.1-2.3.1
Who cares free-fs, java, self-hosted
pom.xml or package.json, depending on how it is deployed)/api/file/stream/preview/{fileId} is reachable by users who are not trustedNo fix yet, per the sources.
Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.