Fireshare version 1.5.1 contains an authenticated path traversal vulnerability (CWE-22) in its chunked upload endpoint. The vulnerability arises because the 'checkSum' multipart field is used directly in filesystem path construction without proper sanitization or containment checks. This allows an attacker with authentication to write files to arbitrary locations writable by the Fireshare process, such as container temporary directories. This improper limitation of pathname can compromise file integrity and may facilitate follow-on attacks depending on the deployment context. The vulnerability is addressed in version 1.5.2.

An authenticated attacker can write arbitrary files outside the intended upload directory, violating file integrity. This may enable further exploitation depending on the deployment environment, such as overwriting critical files or placing malicious payloads in writable paths. The vulnerability does not directly impact confidentiality or availability but poses a high integrity risk.

Upgrade to fireshare version 1.5.2 or later, where this path traversal vulnerability is fixed. Since this is an authenticated vulnerability, ensure that only trusted users have upload permissions until the upgrade is applied. Patch status is confirmed fixed in version 1.5.2.