Threats tagged 'ghsa-cv2f-54jp-59ch'

Dromara free-fs versions 2.0.1 through 2.3.1 have a missing authentication vulnerability in the FileStreamController.preview endpoint. This flaw allows unauthenticated attackers to download stored files by using a file ID obtained from share listings or preview links. The vulnerability enables unauthorized access to any user's or workspace's files without requiring authentication.