EUVD-2026-18507Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied to the authenticated /api/uploadChunked endpoint but was not applied to the unauthenticated /api/uploadChunked/public endpoint in the same file (app/server/fireshare/api.py). An unauthenticated attacker can exploit the checkSum parameter to write arbitrary files with attacker-controlled content to any writable path on the server filesystem. This issue has been patched in version 1.5.3.
AnalysisAI
Arbitrary file write in Fireshare <1.5.3 allows unauthenticated remote attackers to upload malicious files to any writable server path via path traversal in the /api/uploadChunked/public endpoint's checkSum parameter. This represents an incomplete fix for CVE-2026-33645, where remediation was applied only to the authenticated endpoint while leaving the public variant exploitable. SSVC confirms publicly available exploit code exists and the vulnerability is automatable with partial technical impact. CVSS 9.1 (Critical) reflects network-accessible, low-complexity exploitation requiring no authentication or user interaction, enabling both integrity and availability compromise.
Technical ContextAI
Fireshare is a self-hosted media and link sharing platform. The vulnerability stems from CWE-22 (Path Traversal) in the file upload chunking API implementation within app/server/fireshare/api.py. When CVE-2026-33645 was remediated, input validation for the checkSum parameter was added to the authenticated /api/uploadChunked endpoint but was inadvertently omitted from the parallel /api/uploadChunked/public endpoint. This parallel public endpoint processes file chunks without authentication and fails to sanitize the checkSum parameter, allowing directory traversal sequences (e.g., ../../) to escape intended upload directories. Attackers can specify arbitrary filesystem paths where the web server process has write permissions, enabling placement of malicious files such as web shells, configuration overwrites, or cron job modifications. The affected product per CPE data is cpe:2.3:a:shaneisrael:fireshare across all versions prior to 1.5.3.
RemediationAI
Upgrade immediately to Fireshare version 1.5.3, released by the vendor to address this vulnerability. The patch is available at https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.3 and implemented in commit b76915607924756e6fa1a5f6c8823c38d611fb24 via pull request 520 (https://github.com/ShaneIsrael/fireshare/pull/520). The fix applies proper input validation to the checkSum parameter in the /api/uploadChunked/public endpoint, consistent with the authenticated endpoint remediation. No workaround exists for versions prior to 1.5.3; operators unable to upgrade immediately should disable or firewall-restrict access to the /api/uploadChunked/public endpoint until patching is complete. Review web server logs for suspicious POST requests to /api/uploadChunked/public with unusual checkSum values or unexpected file placements outside standard upload directories as indicators of exploitation attempts.
FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint
Fireshare version 1.5.1 allows authenticated remote attackers to write arbitrary files outside the intended upload direc
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today