CVE-2026-129164 · Package
NO FIX YET · SEE WHAT TO DO
Dromara free-fs versions 2.0.1 through 2.3.1 check share codes only in the browser, so the server does not require them. An attacker who knows a share ID can list and download the files in a code-protected share, including preview-only shares.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run free-fs 2.0.1 through 2.3.1 and use share codes to protect file shares are exposed, since the server does not enforce the code. Deployments that do not use share codes, or that run a version outside this range, are not affected by this flaw.
Not affected if no-share-codes, version-outside-range
Who cares file-sharing, free-fs, self-hosted
2.0.1 through 2.3.1Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files without the code, even on preview-only shares.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.