CVE-2026-54337criticalCWE-88

CVE-2026-54337: critical vulnerability in ShaneIsrael fireshare

Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite

Published · Updated

Follow this CVE+ Monitor fireshare

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 0.6%
from disclosure to weaponsame day
Published on NVDSep 15
1st PoCJun 20
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ShaneIsrael · fireshare
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ShaneIsrael fireshare

In the same product, most dangerous first.

CVE-2025-67728CRITICALFireshare Public Uploads feature is vulnerable to OS Command Injection (RCE)EPSS 0.7%CVE-2026-34745CRITICALUnauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/publicEPSS 0.6%CVE-2026-33645HIGHFireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`EPSS 0.4%CVE-2026-54544HIGHFireshare has unauthenticated SSRF via missing login_required on webhook test endpointsEPSS 0.4%