CVE-2026-54544 Details
Description
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login_required decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare server to issue an arbitrary HTTP POST to any URL the attacker supplies, including internal network addresses and cloud metadata services. No credentials, session cookies, or prior access are required. Version 1.6.16 contains a patch.
A server-side request forgery (SSRF) vulnerability has been identified in Fireshare versions prior to 1.6.16. Two API endpoints, '/api/test-discord-webhook' and '/api/test-webhook', are missing the required authentication decorator, allowing unauthenticated attackers to send POST requests that trigger outbound HTTP requests to any URL specified by the attacker. This includes the potential to access internal network addresses and cloud metadata services. The vulnerability arises because these endpoints lack proper authentication, enabling unauthorized access to functionality that can manipulate external services.
Users can upgrade to Fireshare version 1.6.16 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-w7j7-gv7f-gj92 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ShaneIsrael/fireshare/commit/3d786848d2d27344d4cdecf1bd0d54294c6ca160 | [email protected] | Source CodeVendor |
| https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-w7j7-gv7f-gj92 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fireshare | 1.6.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |