Threats affecting pkg:github/free-fs

free-fs versions 2.0.1 through 2.3.1 have an SQL injection vulnerability in the FileShareServiceImpl.getPages method. This flaw allows authenticated users to inject malicious SQL via the orderBy parameter in the /apis/share/pages endpoint, which is used directly in an ORDER BY clause without proper validation. Exploitation can lead to unauthorized reading of arbitrary database contents, such as share codes.

Dromara free-fs versions 2.0.1 through 2.3.1 have a vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes. The flaw exists in the PUT /apis/user/forget-password endpoint, where attackers can request a reset code for a known email and submit unlimited guesses during the code's 300-second validity period. Successful exploitation enables account takeover by setting a chosen password.

Dromara free-fs versions 2.0.1 through 2.3.1 have a missing authentication vulnerability in the FileStreamController.preview function. This flaw allows unauthenticated attackers to download stored files by requesting the preview endpoint with a valid file ID. Attackers can obtain file IDs from share listings or preview links, enabling unauthorized access to any user's or workspace's files.

Dromara free-fs versions 2.0.1 through 2.3.1 have a stored cross-site scripting (XSS) vulnerability. Registered users can upload HTML files that are served inline as text/html, enabling execution of malicious scripts in the context of the application. Attackers can exploit this by sending victims a crafted preview link to execute scripts that interact with the application's API endpoints, potentially exposing victim files and account data.

Dromara free-fs versions 2.0.1 through 2.3.1 have an authorization bypass vulnerability due to client-side enforcement of share codes. Attackers who know a share ID can access and download files from code-protected shares without needing the share code, even for preview-only shares.