CVE-2026-34745

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied to the authenticated /api/uploadChunked endpoint but was not applied to the unauthenticated /api/uploadChunked/public endpoint in the same file app/server/fireshare/api.py. An...

CVE-2026-34745

Fireshare: CVE-2026-34745 is an unauthenticated path-traversal/arbitrary file-write vulnerability in the public chunked-upload endpoint (/api/uploadChunked/public). Before 1.5.3, the fix applied to the authenticated endpoint (/api/uploadChunked) was not propagated to the public one, allowing an a...

CVE-2026-33645 Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`

Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write arbitrary files outside the intended upload directory. The checkSum multipart field is used directly in...

CVE-2026-33645 Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`

Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write arbitrary files outside the intended upload directory. The checkSum multipart field is used directly in...

CVE-2026-33645

Fireshare contains a path traversal vulnerability in the chunked upload endpoint (version 1.5.1) that allows an authenticated attacker to write arbitrary files outside the intended upload directory by abusing the checkSum field in filesystem path construction. This can enable writes to attacker‑c...

CVE-2026-33645 Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`

Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write arbitrary files outside the intended upload directory. The checkSum multipart field is used directly in...