CVE-2026-54337— Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite
Quick assessment
Affected
ShaneIsrael fireshare
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Fireshare 支持自托管的媒体和链接共享。在 1.6.14 版本之前，视频上传功能中存在参数注入漏洞，允许未经身份验证的攻击者写入或覆盖系统文件。该问题已在 1.6.14 版本中得到修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54337
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite
Source: CVE Program / CVE List V5
Vulnerability Description
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ShaneIsrael | fireshare | < 1.6.14 | - |
|
II. Public POCs for CVE-2026-54337
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54337
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54337 (1)
IV. Related Vulnerabilities
Same product: fireshare
-
CVE-2026-54544
Fireshare has unauthenticated SSRF via missing login_require -
CVE-2026-34745
Unauthenticated Path Traversal Arbitrary File Write in /api/ -
CVE-2026-33645
Fireshare has Path Traversal Arbitrary File Write in `/api/u -
CVE-2025-67728
Fireshare Public Uploads feature is vulnerable to OS Command
Same vendor: ShaneIsrael
-
CVE-2026-54544
Fireshare has unauthenticated SSRF via missing login_require -
CVE-2026-34745
Unauthenticated Path Traversal Arbitrary File Write in /api/ -
CVE-2026-33645
Fireshare has Path Traversal Arbitrary File Write in `/api/u -
CVE-2025-67728
Fireshare Public Uploads feature is vulnerable to OS Command
Same weakness: CWE-88
-
CVE-2026-76866
Netcore NR255-V 1.5.130703 OS Command Argument Injection via -
CVE-2026-76862
Netcore NR255-V 1.5.130703 OS Command Argument Injection in -
CVE-2026-55887
MCP Gateway: Argument injection via OCI image label YAML in -
CVE-2026-19624
NetworkManager-l2tp: local privilege escalation via ipsec.co -
CVE-2026-90809
HKUDS nanobot ExecTool shell.py ExecTool._spawn argument inj
V. Comments for CVE-2026-54337
No comments yet