CVE-2026-54337

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: 0.63%; 48th pct
KEV: No
Class: oss containerizable; CWE-88

Description

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.

References

https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-hmh2-6g84-q8jx

Status: profiled · ingested 2026-09-30T18:00:02.000Z