# CVE-2026-34745: ShaneIsrael Fireshare path traversal in public upload API

Source: https://junglewise.ai/threats/cve-2026-34745-shaneisrael-fireshare-path-traversal-in-public-upload-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34745 · Severity: critical · CVSS 9.1 · Published 2026-04-02

Fireshare, a self-hosted media and link sharing platform, contains a critical security flaw in its public upload feature. An unauthenticated attacker can exploit this to write or overwrite files anywhere on the server's filesystem. This could lead to a complete system takeover, data loss through file overwriting, or a total service outage.

Technologies: [Shaneisrael Fireshare](https://junglewise.ai/threats/technologies/fireshare). Vendors: [Shaneisrael](https://junglewise.ai/threats/vendors/shaneisrael).

## Quick answers

**Is CVE-2026-34745 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34745 being exploited in the wild.

**How severe is CVE-2026-34745?** Critical severity, with a CVSS score of 9.1, published 2 April 2026.

**Which products and versions are affected?** Shaneisrael Fireshare < 1.5.3.

**Is there a fix for CVE-2026-34745?** A patch was published on 2026-03-30: Fix merged and version 1.5.3 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34745 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34745?** Check whether you run Shaneisrael Fireshare at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the unauthenticated `/api/uploadChunked/public` endpoint in `app/server/fireshare/api.py`. The `checkSum` parameter is used in `os.path.join()` without sanitization or path validation, allowing an attacker to escape the intended upload directory using `../` sequences. By providing a malicious `checkSum` and a file blob, an attacker can write arbitrary content to any writable path on the server. This can be leveraged for Remote Code Execution (RCE) by overwriting application modules or system configuration files. This issue is a regression/omission where a previous fix for CVE-2026-33645 was applied to the authenticated endpoint but not the public one. The vulnerability is patched in version 1.5.3.

## Affected products

- ShaneIsrael Fireshare < 1.5.3

## Timeline

- 2026-03-30: patched: Fix merged and version 1.5.3 released.
- 2026-03-30: advisory: Vendor security advisory published.
- 2026-04-02: disclosed: CVE-2026-34745 published to NVD.

## References

- [https://github.com/ShaneIsrael/fireshare/commit/b76915607924756e6fa1a5f6c8823c38d611fb24](https://github.com/ShaneIsrael/fireshare/commit/b76915607924756e6fa1a5f6c8823c38d611fb24)
- [https://github.com/ShaneIsrael/fireshare/pull/520](https://github.com/ShaneIsrael/fireshare/pull/520)
- [https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.3](https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.3)
- [https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-fvvp-rj8g-c7gc](https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-fvvp-rj8g-c7gc)

## Related threats

- [Fireshare SSRF via missing authentication on webhook endpoints](https://junglewise.ai/threats/cve-2026-54544-fireshare-ssrf-via-missing-authentication-on-webhook-endpoints)
- [Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or…](https://junglewise.ai/threats/cve-2025-67728-fireshare-facilitates-self-hosted-media-and-link-sharing-versions)