CVE-2026-129164: Dromara free-fs 2.0.1 through 2.3.1 Share Code and Permission Scope Bypass
Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files without the code, even on preview-only shares.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to know a share ID. No share code, authenticated account, or user interaction is required to call the affected share-items and download endpoints.
Are preview-only shares protected from download through this vulnerability?
No. The issue allows files to be listed and downloaded without the share code, including from shares configured as preview-only.
Which deployments are affected?
Dromara free-fs versions 2.0.1 through 2.3.1 are affected where code-protected shares are exposed. Any share ID should be treated as insufficiently protected because code validation occurs only in the client.