CVE-2025-67728

CRITICAL EPSS 43.8%
Published Dec 12, 20256mo ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Dec 12, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file. The malicious filename is then concatenated directly into a shell command, which can be used for uploading files to arbitrary directories via path traversal, or executing system commands for Remote Code Execution (RCE). This issue is fixed in version 1.3.0.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
43.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-77 Command Injection Injection

Affected Products 1

VendorProductVersionRange
shaneisraelfireshare* <1.3.0

References 2

  • github.com https://github.com/ShaneIsrael/fireshare/commit/157386c85f6683f89192dae52115069b435b6d34
    Patch
  • github.com https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-c4f5-g622-q72m
    Vendor Advisory

Remediation

  • github.com https://github.com/ShaneIsrael/fireshare/commit/157386c85f6683f89192dae52115069b435b6d34
    Patch