Critical Argument Injection in Fireshare Lets Attackers Overwrite Files

Executive Summary

A critical argument injection vulnerability (CVE-2026-54337) has been disclosed in Fireshare, a self-hosted media and link sharing platform. The flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker write or overwrite arbitrary files on the host by smuggling extra command-line flags into the backend's video-processing call during upload. A fix is available in version 1.6.14.

CVSS Score: 9.8 (Critical)

Vulnerability Overview

Affected Versions

How the Exploit Works

Fireshare's public upload handler accepts a filename and folder value from the multipart form submission and passes elements derived from them into an ffmpeg-style command line used to process the uploaded video. Because those values aren't strictly separated from command arguments, an attacker can smuggle flags such as -select_streams and -o into the invocation, redirecting where the processed output gets written.

A public proof-of-concept demonstrates the technique with a crafted curl request:

curl -F "file=@video.mp4;filename=target -select_streams v.mp4" \
     -F "folder=target_path -o /destination/path" \
     http://TARGET/api/upload/public

Because the injected -o flag controls the output destination, the attacker effectively gets an arbitrary file write primitive — no login, API key, or prior access required.

Impact of Successful Exploitation

Fireshare's default deployment runs the web process under a restricted user with write access effectively limited to /data, /processed, /images, and /videos — which caps the blast radius on a stock install, but does not require authentication to trigger.

Remediation

Step 1: Update to Version 1.6.14

Pull the latest Fireshare image or release and redeploy:

docker compose pull fireshare
docker compose up -d fireshare

Confirm the running version matches 1.6.14 or later before treating the instance as remediated.

Step 2: Restrict Exposure

If immediate patching isn't possible:

1. Do not expose the /api/upload/public endpoint directly to the internet — place it behind authentication at a reverse proxy or VPN.
2. Review the container's filesystem permissions to ensure the service account cannot write outside its intended data directories.
3. Monitor for unexpected writes to db.sqlite or other core application files.

Step 3: Check for Compromise

# Look for unexpected file modification timestamps outside normal upload activity
find /data /processed /images /videos -newer /path/to/known-good-reference -type f
 
# Confirm the SQLite database hasn't been overwritten or corrupted
sqlite3 /data/db.sqlite "PRAGMA integrity_check;"

References

• GitHub Security Advisory — GHSA-hmh2-6g84-q8jx
• NIST NVD — CVE-2026-54337
• 4qu4r1um/CVE-2026-54337-PoC

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• CVE-2026-61559: Critical SSRF and Token Leakage in GitLab MCP
• CVE-2026-61568: DNS Rebinding in GitLab MCP Server