fireshare vulnerabilities
CVEs whose affected-version data names the fireshare package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-54544High· 7.2PoCFireshare facilitates self-hosted media and link sharing
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login_required decorator. An unauthenticated attacker can call POST /api/test-disco…
CVE-2026-54337Critical· 9.8PoCFireshare facilitates self-hosted media and link sharing
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.
CVE-2025-67728Critical· 9.8Fireshare facilitates self-hosted media and link sharing
Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file.…