CVE-2025-67728

Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file. The malicious filename is then concatenated directly into a shell command, which can be used for uploading files to arbitrary directories via path traversal, or executing system commands for Remote Code Execution (RCE). This issue is fixed in version 1.3.0.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ShaneIsrael/fireshare/commit/157386c85f6683f89192dae52115069b435b6d34	Patch
https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-c4f5-g622-q72m	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:shaneisrael:fireshare:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Fireshare facilita el intercambio de medios y enlaces autoalojados. Las versiones 1.2.30 e inferiores permiten a un usuario autenticado, o a un usuario no autenticado si la configuración de 'Cargas Públicas' está habilitada, crear un nombre de archivo malicioso al subir un archivo de video. El nombre de archivo malicioso se concatena directamente en un comando de shell, que puede usarse para subir archivos a directorios arbitrarios mediante salto de ruta, o ejecutar comandos del sistema para Ejecución Remota de Código (RCE). Este problema está solucionado en la versión 1.3.0.

Information

Published : 2025-12-12 07:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-67728

Mitre link : CVE-2025-67728

CVE.ORG link : CVE-2025-67728

JSON object : View

Products Affected

shaneisrael

fireshare

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-67728", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67728", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-12T20:40:18.178513Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ShaneIsrael", "product": "fireshare", "versions": [{"status": "affected", "version": "< 1.3.0"}]}]}], "published": "2025-12-12T07:15:45.250", "references": [{"url": "https://github.com/ShaneIsrael/fireshare/commit/157386c85f6683f89192dae52115069b435b6d34", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-c4f5-g622-q72m", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file. The malicious filename is then concatenated directly into a shell command, which can be used for uploading files to arbitrary directories via path traversal, or executing system commands for Remote Code Execution (RCE). This issue is fixed in version 1.3.0."}, {"lang": "es", "value": "Fireshare facilita el intercambio de medios y enlaces autoalojados. Las versiones 1.2.30 e inferiores permiten a un usuario autenticado, o a un usuario no autenticado si la configuraci\u00f3n de 'Cargas P\u00fablicas' est\u00e1 habilitada, crear un nombre de archivo malicioso al subir un archivo de video. El nombre de archivo malicioso se concatena directamente en un comando de shell, que puede usarse para subir archivos a directorios arbitrarios mediante salto de ruta, o ejecutar comandos del sistema para Ejecuci\u00f3n Remota de C\u00f3digo (RCE). Este problema est\u00e1 solucionado en la versi\u00f3n 1.3.0."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shaneisrael:fireshare:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30E24CA7-FC23-4509-8F87-ACEE1ADD5BDB", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}