{"id":"CVE-2026-129163","kind":"vulnerability","aliases":["CVE-2026-129163"],"related":[],"title":"free-fs: uploaded HTML files run script in the app origin","description":"Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account.","summary":"Dromara free-fs versions 2.0.1 through 2.3.1 serve uploaded HTML files inline as text/html, so a registered user can plant a file that runs script. A victim who opens the preview link runs that script in the application's origin, which can call the /apis endpoints to read the victim's files and account.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["free-fs","java","package","self-hosted"],"not_affected_if":["version-outside-2.0.1-2.3.1"],"how_to_check":"- Check the free-fs version in the project's dependency file (for example `pom.xml` or `package.json`, depending on how it is deployed)\n- Confirm whether the file preview endpoint `/api/file/stream/preview/{fileId}` is reachable by users who are not trusted","fix":null,"status":"open","published_at":"2026-11-13T18:17:41+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:50+00:00","updated_at":"2026-11-13T18:51:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T18:51:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"free-fs: uploaded HTML files run script in the app origin","impact":"high","summary":"Dromara free-fs versions 2.0.1 through 2.3.1 serve uploaded HTML files inline as text/html, so a registered user can plant a file that runs script. A victim who opens the preview link runs that script in the application's origin, which can call the /apis endpoints to read the victim's files and account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["free-fs","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs as victim, reading files and account data","analyst_note":"Confirm the fixed version and any mitigation from the Dromara free-fs project and the VulnCheck advisory; the sources state no fix.","how_to_check":"- Check the free-fs version in the project's dependency file (for example `pom.xml` or `package.json`, depending on how it is deployed)\n- Confirm whether the file preview endpoint `/api/file/stream/preview/{fileId}` is reachable by users who are not trusted","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-2.0.1-2.3.1"],"who_is_affected":"Deployments of free-fs in the 2.0.1 to 2.3.1 range where registered users can upload files and other users can open previews. The sources do not say whether a default configuration is affected or whether private deployments are exempt. Teams that run a version outside that range can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000749,"input_tokens":4605,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129163':15A,18A '-2026':14A,17A '/api/file/stream/preview':118C '/apis':72B,129C '2.0.1':32B,86C '2.3.1':34B,88C 'account':81B,138C 'allow':98C 'app':11A 'applic':65B,126C 'attack':112C 'call':70B,128C 'contain':89C 'cross':93C 'cross-sit':92C 'cve':13A,16A 'dromara':27B,82C 'endpoint':73B,130C 'execut':122C 'expos':132C 'file':6A,38B,49B,79B,107C,136C 'fileid':119C 'free':2A,20B,29B,84C 'free-f':1A,19B,28B,83C 'fs':3A,21B,30B,85C 'host':26B 'html':5A,37B,106C 'inlin':39B,109C 'java':22B 'link':59B,120C 'open':56B 'origin':12A,67B,127C 'packag':23B 'plant':47B 'preview':58B 'read':75B 'regist':44B,99C 'run':7A,51B,60B,102C 'script':8A,52B,62B,95C,103C,123C 'self':25B 'self-host':24B 'send':114C 'serv':35B,108C 'site':94C 'store':91C 'text/html':41B,111C 'upload':4A,36B,105C 'user':45B,100C 'version':31B 'victim':54B,77B,116C,134C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Deployments of free-fs in the 2.0.1 to 2.3.1 range where registered users can upload files and other users can open previews. The sources do not say whether a default configuration is affected or whether private deployments are exempt. Teams that run a version outside that range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freefs","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-129163':15A,18A '-2026':14A,17A 'app':11A 'cve':13A,16A 'file':6A 'free':2A 'free-f':1A 'fs':3A 'html':5A 'origin':12A 'run':7A 'script':8A 'upload':4A","search_b":"'/apis':72B '2.0.1':32B '2.3.1':34B 'account':81B 'applic':65B 'call':70B 'dromara':27B 'endpoint':73B 'file':38B,49B,79B 'free':20B,29B 'free-f':19B,28B 'fs':21B,30B 'host':26B 'html':37B 'inlin':39B 'java':22B 'link':59B 'open':56B 'origin':67B 'packag':23B 'plant':47B 'preview':58B 'read':75B 'regist':44B 'run':51B,60B 'script':52B,62B 'self':25B 'self-host':24B 'serv':35B 'text/html':41B 'upload':36B 'user':45B 'version':31B 'victim':54B,77B","search_c":"'/api/file/stream/preview':118C '/apis':129C '2.0.1':86C '2.3.1':88C 'account':138C 'allow':98C 'applic':126C 'attack':112C 'call':128C 'contain':89C 'cross':93C 'cross-sit':92C 'dromara':82C 'endpoint':130C 'execut':122C 'expos':132C 'file':107C,136C 'fileid':119C 'free':84C 'free-f':83C 'fs':85C 'html':106C 'inlin':109C 'link':120C 'origin':127C 'regist':99C 'run':102C 'script':95C,103C,123C 'send':114C 'serv':108C 'site':94C 'store':91C 'text/html':111C 'upload':105C 'user':100C 'victim':116C,134C 'vulner':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129163","severity":null,"published_at":"2026-11-13T18:17:41+00:00","modified_at":"2026-11-13T18:17:41+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null}],"documents":[{"id":148620,"url":"https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-stored-xss-via-file-preview-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}