CVE-2026-129162 | Dromara free-fs up to 2.3.1 Preview /api/file/stream/preview FileStreamController.preview fileId missing authentication

A vulnerability was found in Dromara free-fs up to 2.3.1. It has been rated as problematic. Affected is the function FileStreamController.preview of the file /api/file/stream/preview of the component Preview. This manipulation of the argument fileId causes missing authentication.

This vulnerability is tracked as CVE-2026-129162. The attack is possible to be carried out remotely. No exploit exists.VulDB Recent EntriesRead More