CVE-2026-54337: Shaneisrael Fireshare

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.

Affected products

• Shaneisrael Fireshare: before 1.6.14 (fixed in 1.6.14)

Published 2026-09-15. Last modified 2026-09-30.