CVE-2026-33645

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33645
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33645.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33645
Aliases
  • GHSA-7q8r-vpq3-89m7
Published
2026-03-26T20:58:21.521Z
Modified
2026-04-10T05:42:53.961751Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`
Details

Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write arbitrary files outside the intended upload directory. The checkSum multipart field is used directly in filesystem path construction without sanitization or containment checks. This enables unauthorized file writes to attacker-chosen paths writable by the Fireshare process (e.g., container /tmp), violating integrity and potentially enabling follow-on attacks depending on deployment. Version 1.5.2 fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33645.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/shaneisrael/fireshare

Affected ranges

Type
GIT
Repo
https://github.com/shaneisrael/fireshare
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
81086490aad3a0528ee44231c417f0c8d64211f6
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "= 1.5.2"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.2
v1.2.20
v1.2.21
v1.2.22
v1.2.23
v1.2.24
v1.2.25
v1.2.26
v1.2.27
v1.2.28
v1.2.3
v1.2.30
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.5.1
v1.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33645.json"