CVE-2026-34745

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied to the authenticated /api/uploadChunked endpoint but was not applied to the unauthenticated /api/uploadChunked/public endpoint in the same file (app/server/fireshare/api.py). An unauthenticated attacker can exploit the checkSum parameter to write arbitrary files with attacker-controlled content to any writable path on the server filesystem. This issue has been patched in version 1.5.3.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ShaneIsrael/fireshare/commit/b76915607924756e6fa1a5f6c8823c38d611fb24	Patch
https://github.com/ShaneIsrael/fireshare/pull/520	Issue Tracking Patch
https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.3	Release Notes
https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-fvvp-rj8g-c7gc	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:shaneisrael:fireshare:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-02 19:21

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34745

Mitre link : CVE-2026-34745

CVE.ORG link : CVE-2026-34745

JSON object : View

Products Affected

shaneisrael

fireshare

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-34745", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34745", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T19:15:35.516472Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ShaneIsrael", "product": "fireshare", "versions": [{"status": "affected", "version": "< 1.5.3"}]}]}], "published": "2026-04-02T19:21:33.340", "references": [{"url": "https://github.com/ShaneIsrael/fireshare/commit/b76915607924756e6fa1a5f6c8823c38d611fb24", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ShaneIsrael/fireshare/pull/520", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-fvvp-rj8g-c7gc", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied to the authenticated /api/uploadChunked endpoint but was not applied to the unauthenticated /api/uploadChunked/public endpoint in the same file (app/server/fireshare/api.py). An unauthenticated attacker can exploit the checkSum parameter to write arbitrary files with attacker-controlled content to any writable path on the server filesystem. This issue has been patched in version 1.5.3."}, {"lang": "es", "value": "Fireshare facilita el intercambio de medios y enlaces autoalojados. Antes de la versi\u00f3n 1.5.3, la correcci\u00f3n para CVE-2026-33645 se aplic\u00f3 al endpoint autenticado /API/uploadChunked pero no se aplic\u00f3 al endpoint no autenticado /API/uploadChunked/public en el mismo archivo (app/server/fireshare/api.py). Un atacante no autenticado puede explotar el par\u00e1metro checkSum para escribir archivos arbitrarios con contenido controlado por el atacante en cualquier ruta escribible en el sistema de archivos del servidor. Este problema ha sido parcheado en la versi\u00f3n 1.5.3."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shaneisrael:fireshare:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD38C642-B601-465E-9D1F-CB73CFF5B954", "versionEndExcluding": "1.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}