CVE-2026-34745: falha crítica em ShaneIsrael fireshare
Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.6%
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied to the authenticated /api/uploadChunked endpoint but was not applied to the unauthenticated /api/uploadChunked/public endpoint in the same file (app/server/fireshare/api.py). An unauthenticated attacker can exploit the checkSum parameter to write arbitrary files with attacker-controlled content to any writable path on the server filesystem. This issue has been patched in version 1.5.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
ShaneIsrael · fireshareCVEs relacionadas — ShaneIsrael fireshare
No mesmo produto, das mais perigosas para as menos.
CVE-2025-67728CRITICALFireshare Public Uploads feature is vulnerable to OS Command Injection (RCE)EPSS 0.7%CVE-2026-54337CRITICALFireshare has Unauthenticated Argument Injection to Arbitrary File Write/OverwriteEPSS 0.6%CVE-2026-33645HIGHFireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`EPSS 0.4%CVE-2026-54544HIGHFireshare has unauthenticated SSRF via missing login_required on webhook test endpointsEPSS 0.4%