CVE-2026-34745
Critical
Description
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied to the authenticated /api/uploadChunked endpoint but was not applied to the unauthenticated /api/uploadChunked/public endpoint in the same file (app/server/fireshare/api.py). An unauthenticated attacker can exploit the checkSum parameter to write arbitrary files with attacker-controlled content to any writable path on the server filesystem. This issue has been patched in version 1.5.3.
SeverityCritical
CVSS9.1
Exploit probability—
ProductShaneisrael Fireshare
PublishedApr 2, 2026
First seenApr 2, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- shaneisrael fireshare1.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shaneisrael fireshare | v < 1.5.3 | 1.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.