CVE-2026-54337

Deferred Deferred - Pending Action

Argument Injection in Fireshare Video Upload

Publication date: 2026-09-15

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-30

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-54337

EUVD

EUVD-2026-79946

Affected Vendors & Products

Vendor	Product	Version / Range
fireshare	fireshare	to 1.6.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

Fireshare before version 1.6.14 has an argument injection vulnerability in its video upload function. This flaw allows unauthenticated attackers to inject malicious arguments into system commands, enabling them to write or overwrite arbitrary files on the server.

Impact Analysis

This vulnerability can lead to complete system compromise. Attackers could overwrite critical system files, install malware, or gain persistent access to the server. It may also allow unauthorized data access or modification depending on the files targeted.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized file access/modification risks. It could lead to data breaches, loss of data integrity, and failure to maintain secure systems as required by these regulations.

Mitigation Strategies

Update Fireshare to version 1.6.14 or later to address the argument injection vulnerability in the video upload function.

Hi! I’m here to help you understand CVE-2026-54337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70