CVE-2026-129162: Dromara free-fs 2.0.1 through 2.3.1 Missing Authentication via File Stream Preview
Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a valid file ID. File IDs may be obtained from share listings or preview links, after which the attacker can request the preview endpoint without authentication.
Are files limited to the attacker’s own account or workspace?
No. A valid file ID can be used to download files belonging to any user or workspace.
Which deployments are affected?
The affected versions are Dromara free-fs 2.0.1 through 2.3.1. The vulnerable behavior is in the FileStreamController.preview endpoint at /api/file/stream/preview/{fileId}.