PT-2026-29874 · Fireshare · Fireshare

Axel-Corsiez · CVE-2026-34745 · Published 2026-04-02 · Updated 2026-04-03

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fireshare versions prior to 1.5.3

Description Fireshare allows self-hosted media and link sharing. Prior to version 1.5.3, a flaw existed in the /api/uploadChunked/public endpoint where an unauthenticated attacker could manipulate the checkSum parameter to write arbitrary files with attacker-controlled content to any writable path on the server filesystem. The fix for a related issue was applied to the authenticated /api/uploadChunked endpoint but not to the unauthenticated one. This allows for remote code execution.

Recommendations Update to version 1.5.3 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-34745

GHSA-FVVP-RJ8G-C7GC

Affected Products

Fireshare

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34745.json · Exploit
• https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-fvvp-rj8g-c7gc · Vendor Advisory
• https://github.com/ShaneIsrael/fireshare/pull/520 · Patch
• https://github.com/ShaneIsrael/fireshare/commit/b76915607924756e6fa1a5f6c8823c38d611fb24 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34745 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34745 · Vendor Advisory
• https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.3 · Note
• https://twitter.com/CveFindCom/status/2039828432733822989 · Twitter Post
• https://twitter.com/0dayPublishing/status/2039782285659029914 · Twitter Post
• https://twitter.com/CVEnew/status/2040128783626166738 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039915838241914909 · Twitter Post