TI-2026-26026 Aliases CVE-2026-33645

Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`

HIGH 68CWE-22Published 2026-03-26 · Updated 2026-03-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write arbitrary files outside the intended upload directory. The `checkSum` multipart field is used directly in filesystem path construction without sanitization or containment checks. This enables unauthorized file writes to attacker-chosen paths writable by the Fireshare process (e.g., container `/tmp`), violating integrity and potentially enabling follow-on attacks depending on deployment. Version 1.5.2 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00438 38th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ShaneIsrael	fireshare	= 1.5.2	—	No fix listed	CNA

fireshare VendorShaneIsrael Affected = 1.5.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:shaneisrael:fireshare:1.5.1:::::::*	1.5.1	Vulnerable	ShaneIsrael

cpe:2.3:a:shaneisrael:fireshare:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·ShaneIsrael

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-33645

References

Advisory 1

https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-7q8r-vpq3-89m7

Other 1

https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.2

TI-2026-26989 Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public CVSS 3.1CRITICAL 9.1
TI-2025-35020 FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the… CVSS 3.1MEDIUM 6.5
TI-2025-41424 Fireshare Public Uploads feature is vulnerable to OS Command Injection (RCE) CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences