CVE-2026-34745 Details

A path traversal vulnerability has been identified in Fireshare versions prior to 1.5.3, specifically in the unauthenticated '/api/uploadChunked/public' endpoint. This vulnerability allows an unauthenticated attacker to exploit the 'checkSum' parameter to write arbitrary files with attacker-controlled content to any writable path on the server filesystem. The issue arises because the 'checkSum' parameter is used directly in file path construction without proper sanitization, enabling path traversal attacks. This vulnerability is particularly severe as it bypasses authentication requirements, allowing unauthorized access to file writing capabilities on the server.

Users are advised to update to Fireshare version 1.5.3 or later, where this vulnerability has been patched by applying proper input sanitization and path traversal guards to the public upload endpoint.