SECURITYCRITICALCVE-2026-54337

Critical Argument Injection in Fireshare Lets Attackers Overwrite Files

CVE-2026-54337 lets unauthenticated attackers inject ffmpeg arguments via Fireshare's video upload endpoint to write or overwrite arbitrary files.

Dylan H.

Security Team

September 16, 2026
3 min read
Critical Argument Injection in Fireshare Lets Attackers Overwrite Files

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Fireshare ≤ 1.6.13

Executive Summary

A critical argument injection vulnerability (CVE-2026-54337) has been disclosed in Fireshare, a self-hosted media and link sharing platform. The flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker write or overwrite arbitrary files on the host by smuggling extra command-line flags into the backend's video-processing call during upload. A fix is available in version 1.6.14.

CVSS Score: 9.8 (Critical)

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-54337
CVSS Score9.8 (Critical)
CWECWE-88 — Argument Injection
TypeUnauthenticated Arbitrary File Write/Overwrite
Attack VectorNetwork (no authentication required)
Privileges RequiredNone
User InteractionNone
LocationPublic video upload API (/api/upload/public)

Affected Versions

ProjectAffected VersionsFixed Version
Fireshare (ShaneIsrael/fireshare)≤ 1.6.131.6.14

How the Exploit Works

Fireshare's public upload handler accepts a filename and folder value from the multipart form submission and passes elements derived from them into an ffmpeg-style command line used to process the uploaded video. Because those values aren't strictly separated from command arguments, an attacker can smuggle flags such as -select_streams and -o into the invocation, redirecting where the processed output gets written.

A public proof-of-concept demonstrates the technique with a crafted curl request:

curl -F "file=@video.mp4;filename=target -select_streams v.mp4" \
     -F "folder=target_path -o /destination/path" \
     http://TARGET/api/upload/public

Because the injected -o flag controls the output destination, the attacker effectively gets an arbitrary file write primitive — no login, API key, or prior access required.

Impact of Successful Exploitation

ImpactDescription
Arbitrary File WriteCreate or overwrite files reachable by the service account
Database CorruptionOverwriting db.sqlite renders the instance unusable (denial of service)
Data LossDestructive overwrites of stored media/config without authentication
Potential PivotDepending on deployment (bind mounts, shared volumes), writable paths outside /data could expand impact

Fireshare's default deployment runs the web process under a restricted user with write access effectively limited to /data, /processed, /images, and /videos — which caps the blast radius on a stock install, but does not require authentication to trigger.

Remediation

Step 1: Update to Version 1.6.14

Pull the latest Fireshare image or release and redeploy:

docker compose pull fireshare
docker compose up -d fireshare

Confirm the running version matches 1.6.14 or later before treating the instance as remediated.

Step 2: Restrict Exposure

If immediate patching isn't possible:

  1. Do not expose the /api/upload/public endpoint directly to the internet — place it behind authentication at a reverse proxy or VPN.
  2. Review the container's filesystem permissions to ensure the service account cannot write outside its intended data directories.
  3. Monitor for unexpected writes to db.sqlite or other core application files.

Step 3: Check for Compromise

# Look for unexpected file modification timestamps outside normal upload activity
find /data /processed /images /videos -newer /path/to/known-good-reference -type f
 
# Confirm the SQLite database hasn't been overwritten or corrupted
sqlite3 /data/db.sqlite "PRAGMA integrity_check;"

References

Related Reading