Fireshare
CVE-2025-67728
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Fireshare upload endpoint
-
DeliveryCraft video filename with shell metacharacters
-
ExploitServer concatenates name into shell command
-
ExecutionInjected OS command executes
-
ImpactRemote code execution as server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to upload a video file to Fireshare (<=1.2.30) via the upload or chunked-upload endpoints, and control over the uploaded file's filename, which is interpolated into a shell command. Authentication IS required by default (any authenticated user suffices); the unauthenticated path is possible ONLY when the non-default 'Public Uploads' setting is explicitly enabled. Limiting factors: the attacker must reach the Fireshare upload API over the network and the target must run an affected version; there is no user-interaction requirement and no special platform dependency beyond the vulnerable code path. Upgrading to 1.3.0 (secure_filename sanitization plus shell=False list-form invocation) removes the condition entirely. |
| Impact | This is a genuine high-severity flaw backed by strong primary evidence: the vendor patch commit (157386c) confirms that user-supplied filenames were concatenated into a shell command executed with Popen(..., shell=True), yielding OS command injection (CWE-77) with full RCE and path traversal. However, the real-world risk signals are mixed against the headline CVSS 9.8. The published vector (AV:N/AC:L/PR:N/UI:N) assumes the unauthenticated path, which only applies when the non-default 'Public Uploads' setting is enabled; in a default deployment exploitation requires an authenticated user, effectively PR:L. EPSS is low (0.69%, 51st percentile) and the CVE is NOT in CISA KEV, with no public exploit identified at time of analysis - so there is no evidence of widespread or active exploitation. Fireshare is a niche self-hosted media-sharing project with a small deployment footprint, further limiting mass-exploitation appeal. Net assessment: a real and easily-weaponizable bug (trivial once the upload endpoint is reachable) but a low-priority item for most organizations unless they actually run Fireshare, especially instances with Public Uploads enabled - patch promptly to 1.3.0 but this is targeted-surface risk, not an internet-wide emergency. |
| Exploit ScenarioDerived | An attacker reaches a Fireshare upload endpoint - either as an authenticated user or, on instances with the 'Public Uploads' setting enabled, with no authentication - and uploads a video whose filename contains shell metacharacters. Because the filename is interpolated directly into a 'fireshare scan-video --path="..."' command run via shell=True, the injected payload executes on the server, giving arbitrary command execution or file writes outside the intended directory. No public exploit code was identified at time of analysis, though the patch diff plainly reveals the injection point. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Operating-system command injection in Fireshare 1.2.30 and earlier lets a user with upload privileges - or any unauthenticated visitor when the non-default 'Public Uploads' setting is turned on - embed shell metacharacters or traversal sequences in an uploaded video's filename, which the application concatenates directly into a shell command. Successful exploitation yields remote code execution in the context of the Fireshare service and allows writing files to arbitrary directories via path traversal. The flaw is rated 9.8 by NVD and assessed at the same impact level (with the caveat that authentication is normally required), and the vendor has shipped a definitive fix in 1.3.0; EPSS places near-term exploitation likelihood at roughly 0.7% (51st percentile), and no public exploit code has been identified at time of analysis.
RemediationAI
Upgrade to Fireshare 1.3.0, which is the vendor-released fix; it sanitizes filenames with secure_filename(), rejects uploads whose sanitized name is empty with HTTP 400, and switches every affected Popen call to list-form execution with shell=False, removing the shell interpretation that enables injection. If upgrading immediately is not possible, disable the non-default 'Public Uploads' setting so that only authenticated users can reach the vulnerable handlers - this reduces but does not eliminate exposure, since any authenticated account can still exploit the flaw. Additionally restrict the upload and chunked-upload endpoints to trusted users or networks (for example via a reverse-proxy allowlist or auth layer), and run the Fireshare container with a read-only or minimally writable filesystem and a non-root, low-privilege service account so that a successful command injection cannot write outside the media directory or persist on the host. A WAF rule blocking shell metacharacters (;, |, &, $, backticks, ../) in multipart filenames and form fields can serve as a stopgap, but it is bypassable and should not be treated as a substitute for the 1.3.0 upgrade.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fireshare is a self-hosted media and link-sharing application built on Python and the Flask/Werkzeug web stack. Its upload and chunked-upload API handlers in app/server/fireshare/api.py took the client-supplied filename verbatim, extracted the file extension from it, and interpolated the resulting path into a command string that was executed through subprocess.Popen(..., shell=True) - for example 'fireshare scan-video --path="{save_path}"'. Because the string is handed to a shell, shell metacharacters in the filename are interpreted by the shell rather than treated as data, the classic CWE-77 improper neutralization of special elements used in a command. The same pattern appears in app/server/fireshare/schedule.py with 'fireshare bulk-import'. The vendor fix, commit 157386c85f6683f89192dae52115069b435b6d34, applies werkzeug.utils.secure_filename() to every attacker-controlled filename (rejecting empty results with HTTP 400) and converts all affected Popen calls to list-form invocation with shell=False, which eliminates shell interpretation entirely. The CPE cpe:2.3:a:shaneisrael:fireshare:*:*:*:*:*:*:*:* confirms the affected component is Fireshare itself rather than an upstream dependency.
Know when Fireshare gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable upload endpoint and trivial injection give AV:N/AC:L; default deployments require an authenticated user so PR:L (PR:N only with non-default Public Uploads); RCE yields C:H/I:H/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file. The malicious filename is then concatenated directly into a shell command, which can be used for uploading files to arbitrary directories via path traversal, or executing system commands for Remote Code Execution (RCE). This issue is fixed in version 1.3.0.
Executive ViewAI
A critical remote code execution vulnerability in Fireshare versions 1.2.30 and earlier allows an attacker with upload privileges, or any visitor if the non-default Public Uploads setting is enabled, to execute arbitrary commands on the hosting server, posing a severe risk of full system compromise and data loss. Organizations using Fireshare for video sharing should treat this as a high-priority remediation, as successful exploitation could lead to lateral movement, data exfiltration, and service disruption. Vendor-released patch: 1.3.0; no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint
Arbitrary file write in Fireshare <1.5.3 allows unauthenticated remote attackers to upload malicious files to any writab
Fireshare version 1.5.1 allows authenticated remote attackers to write arbitrary files outside the intended upload direc
Exploit-DB