CVE-2026-129160: Dromara free-fs 2.0.1 through 2.3.1 SQL Injection via orderBy Parameter
free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
free-fs versions 2.0.1 through 2.3.1 are affected. The vulnerable code is associated with the /apis/share/pages endpoint.
Does an attacker need an account?
Yes. Exploitation requires an authenticated user with access to send requests to the affected endpoint; no user interaction is required.
What access can exploitation provide?
An attacker can inject CASE WHEN subquery expressions through the orderBy parameter and use share ordering as a boolean oracle. This can expose arbitrary database contents, including share codes.
How can I assess whether my instance is exposed?
Check whether the deployment runs a version from 2.0.1 through 2.3.1 and exposes /apis/share/pages to authenticated users. Requests that allow unvalidated orderBy values to reach the ORDER BY clause indicate exposure.