ShaneIsrael fireshare before version 1.5.3 contains a path traversal vulnerability (CWE-22) in the unauthenticated /api/uploadChunked/public endpoint. Although a fix for a similar issue (CVE-2026-33645) was applied to the authenticated upload endpoint, the public endpoint remained vulnerable. An attacker can manipulate the checkSum parameter to write arbitrary files anywhere on the server's writable filesystem, potentially leading to code execution or denial of service. This vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity. The issue was addressed in fireshare version 1.5.3.

An unauthenticated attacker can write arbitrary files with attacker-controlled content to any writable path on the server hosting fireshare versions prior to 1.5.3. This can lead to severe impacts including integrity compromise and availability disruption. The vulnerability does not require authentication or user interaction, increasing its risk. There are no known exploits in the wild at the time of this report.

Upgrade fireshare to version 1.5.3 or later, where this vulnerability has been patched. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor's versioning information.