Executive brief
Fireshare is a self-hosted media and file sharing platform. An unauthenticated attacker can exploit a flaw in the video upload function to write or overwrite arbitrary system files, potentially leading to data destruction, application compromise, or complete server takeover.
Technical details
The vulnerability is an argument injection (CWE-88) in the video upload API endpoint. The vulnerable code path is: user-supplied filename and folder parameters are insufficiently sanitized (spaces are retained), then passed unsanitized to a shell command that invokes ffprobe via string splitting. An attacker can craft a filename with shell metacharacters and arguments (e.g., `-o data`) that are interpreted as ffprobe command-line flags, allowing arbitrary file writes. The attack requires only network access and no authentication. The fix was released in version 1.6.14.
Affected products
- Fireshare Fireshare < 1.6.14
Timeline
- 2026-06-04: disclosed
- 2026-06-04: patched: Version 1.6.14