Is CVE-2026-54544 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54544 being exploited in the wild.

How severe is CVE-2026-54544?

High severity, with a CVSS score of 7.2, published 15 September 2026.

Which products and versions are affected?

Shaneisrael Fireshare prior to 1.6.16.

Is there a fix for CVE-2026-54544?

A patch was published on 2026-09-15: Fix released in version 1.6.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54544 attacked?

It is attacked over the network.

Am I affected by CVE-2026-54544?

Check whether you run Shaneisrael Fireshare at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54544: Fireshare SSRF via missing authentication on webhook endpoints

CVE-2026-54544 · Severity: high · CVSS 7.2 · Published 2026-09-15

Fireshare is a self-hosted media and file sharing platform. Two API endpoints that test webhook integrations lack proper authentication controls, allowing any unauthenticated attacker to make arbitrary HTTP POST requests from the Fireshare server to any internal or external destination. This enables attackers to probe internal networks, access cloud metadata services to steal credentials, and bypass firewalls using the Fireshare instance as a proxy.

Technologies: Shaneisrael Fireshare. Vendors: Shaneisrael.

Quick answers

Is CVE-2026-54544 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54544 being exploited in the wild.
How severe is CVE-2026-54544?: High severity, with a CVSS score of 7.2, published 15 September 2026.
Which products and versions are affected?: Shaneisrael Fireshare prior to 1.6.16.
Is there a fix for CVE-2026-54544?: A patch was published on 2026-09-15: Fix released in version 1.6.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54544 attacked?: It is attacked over the network.
Am I affected by CVE-2026-54544?: Check whether you run Shaneisrael Fireshare at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) caused by missing @login_required decorators on two Flask API endpoints: POST /api/test-discord-webhook and POST /api/test-webhook in app/server/fireshare/api/misc.py. The endpoints accept attacker-supplied webhook URLs and make unconditional requests.post() calls without URL validation, scheme restrictions, or allowlisting. An unauthenticated attacker can POST a malicious webhook_url parameter to reach internal services (127.0.0.1, 169.254.169.254 in AWS), Docker-local services, or external attacker-controlled servers. The underlying send_discord_webhook() and send_generic_webhook() functions in cli.py perform no filtering. Versions prior to 1.6.16 are affected; the fix adds the @login_required decorator to both endpoints, preventing unauthenticated access.

Affected products

ShaneIsrael Fireshare prior to 1.6.16

Timeline

2026-06-10: disclosed
2026-09-15: advisory
2026-09-15: patched: Fix released in version 1.6.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.