{"cve":"CVE-2026-33645","nvd":{"published":"2026-03-26T21:17:07.940","modified":"2026-06-17T10:37:50.420","status":"Analyzed","description":"Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write arbitrary files outside the intended upload directory. The `checkSum` multipart field is used directly in filesystem path construction without sanitization or containment checks. This enables unauthorized file writes to attacker-chosen paths writable by the Fireshare process (e.g., container `/tmp`), violating integrity and potentially enabling follow-on attacks depending on deployment. Version 1.5.2 fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1},"cwes":["CWE-22","CWE-73"],"references":["https://github.com/ShaneIsrael/fireshare/releases/tag/v1.5.2","https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-7q8r-vpq3-89m7","https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-7q8r-vpq3-89m7"],"products":["shaneisrael:fireshare"],"source":"nvd","synced_at":"2026-10-19T22:28:18.033120106+00:00"},"epss":{"cve":"CVE-2026-33645","score":0.00438,"percentile":0.38111,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}