CVE-2026-54337

CVSS 9.8 (critical) · published 2026-09-15

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.

Weakness: CWE-88

Source: NVD CVE-2026-54337

References

• https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-hmh2-6g84-q8jx

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.