EUVD-2026-16416Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write arbitrary files outside the intended upload directory. The checkSum multipart field is used directly in filesystem path construction without sanitization or containment checks. This enables unauthorized file writes to attacker-chosen paths writable by the Fireshare process (e.g., container /tmp), violating integrity and potentially enabling follow-on attacks depending on deployment. Version 1.5.2 fixes the issue.
AnalysisAI
Fireshare version 1.5.1 allows authenticated remote attackers to write arbitrary files outside the intended upload directory through unsanitized path traversal in the chunked upload endpoint's checkSum parameter. The vulnerability enables attackers with valid credentials to write files to any location accessible to the Fireshare process, potentially compromising system integrity or enabling secondary attacks. No public exploit identified at time of analysis, though the vulnerability has been fixed in version 1.5.2 released by the vendor.
Technical ContextAI
Fireshare is a self-hosted media and link sharing application developed by ShaneIsrael (CPE: cpe:2.3:a:shaneisrael:fireshare). This vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The flaw exists in the chunked upload endpoint where the checkSum multipart field is concatenated directly into filesystem path operations without validation or canonicalization. An attacker can inject directory traversal sequences (e.g., '../') to escape the intended upload directory and write to arbitrary locations accessible by the application process, such as /tmp in containerized deployments. This represents a classic failure to implement proper input validation and path containment checks before filesystem operations.
RemediationAI
Upgrade Fireshare to version 1.5.2 or later, which contains the vendor-released fix for this path traversal vulnerability as documented at https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.2 and confirmed in the security advisory at https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-7q8r-vpq3-89m7. Until patching is completed, implement defense-in-depth mitigations including running the Fireshare process with minimal filesystem permissions, deploying within containerized environments with read-only root filesystems where feasible, restricting authenticated user access to trusted accounts only, and monitoring file write operations for anomalous activity outside expected directories. Network-level access controls should limit exposure to authorized users and networks.
FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint
Arbitrary file write in Fireshare <1.5.3 allows unauthenticated remote attackers to upload malicious files to any writab
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today