CVE-2026-54337

Executive Summary

CVE-2026-54337 is a critical (CVSS 9.8) argument injection vulnerability in Fireshare, a self-hosted media and link-sharing application. Prior to version 1.6.14, the video upload function accepts unauthenticated input that is passed unsafely into a downstream command or process, allowing a remote attacker with no credentials to write to or overwrite system files on the host. Any internet-exposed Fireshare instance below 1.6.14 is fully at risk, with high impact to confidentiality, integrity, and availability.

Technical Analysis

The vulnerability class is CWE-88 (Improper Neutralization of Argument Delimiters in a Command). In an argument injection flaw, untrusted input is not interpreted as an executable name (as in classic OS command injection) but instead as an additional argument to a process that the application is already invoking. The attacker controls a value that is concatenated into an argument list — commonly reached through a media-processing utility such as ffmpeg or a shell wrapper — and can inject delimiter characters (for example leading dashes --, whitespace, or quoting characters depending on the invocation style) so that the target utility reinterprets attacker data as flags or file operands.

Per the NVD description, the vulnerable component is specifically the video upload function, and the entry point is unauthenticated. The disclosed impact is arbitrary file write / overwrite on the host filesystem. This is a meaningful escalation: rather than merely reading a file or causing a crash, an attacker can place a file with attacker-controlled name and content at a path of their choosing, subject to the privileges of the Fireshare service process. File write primitives of this kind are frequently chained into further compromise (for example, overwriting configuration, startup, or scheduled-task files) but the NVD description does not enumerate a specific escalation path, so no such chain should be assumed beyond the stated write/overwrite capability.

Affected deployment: self-hosted Fireshare instances that expose the upload endpoint to untrusted networks (typically internet-facing Docker deployments behind a reverse proxy). CVSS v3.1 places this at AV:N/AC:L/PR:N/UI:N (network-reachable, low complexity, no privileges, no user interaction), with C:H/I:H/A:H — the maximum impact across all three security properties. EPSS has not been assigned by FIRST.org at the time of writing; no exploitation evidence is available.

Exploitation Scenarios

Note: No public PoC or Nuclei template is available for CVE-2026-54337. The chain below describes the attack at the vulnerability-class level, consistent with CWE-88 and the stated "unauthenticated video upload → file write" impact. No specific function names, parameters, or paths are asserted because the source description does not disclose them.

1. Reconnaissance / target identification. The attacker fingerprints exposed Fireshare instances — recognizable via HTTP response title/content and the characteristic upload UI — using internet-wide scanners or Shodan. The presence of the media upload form and an unauthenticated upload endpoint identifies a candidate target set. Version detection (e.g., the application's version banner or a known asset hash) filters to instances below 1.6.14.

2. Triggering the flaw (argument injection class). The attacker issues a crafted HTTP request to the video upload functionality. The request contains a value (file name, container/metadata field, or an upload parameter) that the server concatenates into the argument vector of a media-handling process without neutralizing argument delimiters. Because the request requires no authentication (PR:N), the attacker can do this directly.

3. Execution / payload (class level). The injected delimiting characters cause the downstream process to interpret attacker-supplied data as extra flags or as an output/operand path. The observable end result described by the disclosure is that the attacker gains the ability to write or overwrite arbitrary system files at paths the attacker selects, using the content they supply. The exact injected tokens are not disclosed in the source data and are therefore not enumerated here.

4. Post-exploitation impact (as disclosed). The confirmed capability is host file write/overwrite. Write primitives are the classic precursor to code execution and persistence (overwriting configuration, service, or task files that are later read by a privileged process); however, the NVD entry states only the write impact, so code execution, persistence, and lateral movement should be treated as plausible downstream consequences rather than confirmed. Impact on confidentiality (C:H) also implies the attacker may be able to read data as a side effect of writing files containing attacker-controlled output or by targeting paths the process can read.

Impact Assessment

• Severity: CRITICAL — CVSS v3.1 base 9.8.
  • AV:N (Network) — exploitable over the network.
  • AC:L (Low) — no special preconditions or race windows implied.
  • PR:N (None) — unauthenticated; no account or token required.
  • UI:N (None) — no victim interaction.
  • S:U (Unchanged) — impact remains scoped to the vulnerable component per the vector (the impact metrics are scored at the host/resource level).
  • C:H / I:H / A:H — high impact to confidentiality, integrity, and availability, consistent with arbitrary file write/overwrite.
• Who is affected: Self-hosted Fireshare operators running any version < 1.6.14, especially those exposing the service to the internet. Containerized (Docker) deployments increase blast radius because files overwritten on the host may affect other containers or the host orchestration layer.
• Business impact: Arbitrary file write on a media server can lead to website defacement, replacement of served content (integrity of shared media/links), corruption of application or OS files causing outage (availability), and, via follow-on chaining, server compromise. Confidentiality impact means content stored on the host may be exfiltrated.
• Blast radius: Any internet-exposed instance. There is no authenticated privilege gate, so the entire exposed population is vulnerable.

Detection Guidance

Sigma Rule

Detects the argument-delimiter patterns characteristic of CWE-88 being submitted to a web upload endpoint. Because no vendor field names are disclosed, this rule keys on injected delimiter substrings in HTTP upload/query data.

title: Suspected Argument Injection via Fireshare Video Upload (CVE-2026-54337)
id: 6c3f7a1e-9b2d-4d51-8f0a-2a5c7b9e4d11
status: experimental
description: Detects argument-delimiter injection patterns in HTTP requests to the Fireshare video upload function (CWE-88). No public PoC; heuristic.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54337
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: POST
  selection_path:
    cs-uri-stem|contains:
      - '/upload'
      - '/api/upload'
  selection_indicators:
    cs-uri-query|contains:
      - '--'
      - '%2D%2D'
      - ' -o '
      - '%20-o%20'
      - ' -f '
      - '%2F..%2F'
    cs-uri-stem|contains:
      - '..%2F'
      - '../'
  condition: selection_method and selection_path and selection_indicators
falsepositives:
  - Legitimate filenames or metadata containing dashes or relative-path-like text
level: high

YARA Rule

Scans for the delimiter patterns and shell-metacharacter sequences that characterize this argument-injection class in captured upload bodies or web logs.

rule CVE_2026_54337_Fireshare_ArgInjection_Upload
{
    meta:
        description = "Heuristic detection of argument-injection payloads targeting the Fireshare video upload function (CVE-2026-54337, CWE-88)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54337"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $up1 = "upload" nocase
        $up2 = "video" nocase
        $up3 = "content-disposition" nocase

        $inj1 = "--" 
        $inj2 = " -o "
        $inj3 = " -f "
        $inj4 = "/etc/"
        $inj5 = "/tmp/"
        $inj6 = "&&"
        $inj7 = "|"
        $inj8 = "%2D%2D" nocase
        $inj9 = "%2Fetc%2F" nocase

    condition:
        (2 of ($up*)) and (2 of ($inj*))
}

Suricata IDS Rule

Network signature for delimiter-injection content in multipart/form-data uploads to the video upload endpoint. This is a heuristic signature — tune to your deployment.

alert http any any -> any any (msg:"CVE-2026-54337 Possible Fireshare Argument Injection in Video Upload (CWE-88)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"upload"; http.uri; content:"video"; nocase; http.client_body; content:"--"; http.client_body; content:" -o "; sid:2026543701; rev:1; metadata:reference nvd.nist.gov/vuln/detail/CVE-2026-54337, created_at 2026_01_01, attack_target Server, signature_severity Critical, cve CVE_2026_54337; classtype:attempted-admin;)

Elastic Detection

EQL around web access logs, matching upload-path POSTs that carry delimiter indicators.

sequence by source.ip with maxspan=1s
  [ network where http.request.method == "POST" and
      (http.request.uri : "*upload*" or http.request.uri : "*video*") and
      (url.query : *"--*" or url.query : *"%2D%2D*" or url.query : *"..%2F*") ]

Splunk SPL Query

Detects POSTs to upload paths with argument-delimiter or path-traversal content in the request, grouped by source IP for triage.

index=web (uri_path="/upload" OR uri_path="*/upload*" OR uri_path="*video*") method=POST
| eval suspicious = if(match(uri_query, "\-\-|%2D%2D| \+| -o | -f |\.\.%2F|\.\./"), 1, 0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip
| sort - count
| table src_ip count first_seen last_seen paths

Wazuh OSSEC Rule

Correlates web-server log entries exhibiting argument-delimiter indicators with high severity.

<group name="web,appsec,cve-2026-54337,">
  <rule id="100543" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <description>CVE-2026-54337: Possible Fireshare video upload argument injection (CWE-88)</description>
    <match>upload</match>
    <regex>--| -o | -f |%2D%2D|\.\.%2F</regex>
    <regex>POST</regex>
  </rule>

  <rule id="100544" level="14" frequency="3" timeframe="60">
    <if_matched_sid>100543</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-54337: Repeated upload argument-injection attempts from same source (possible exploitation)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) reports that Fireshare 1.6.14 fixes the issue. This has not been independently confirmed, and no vendor advisory or diff was available for review. Treat the patch reference as provisional and verify against the project's official release notes before relying on it.

1. Immediate mitigations (no patch assumed):

   • Remove internet exposure: place Fireshare behind an authenticating reverse proxy or VPN. The vulnerability is unauthenticated (PR:N), so requiring authentication at the edge nullifies the practical attack path.
   • Restrict the upload endpoint to trusted networks/IP ranges at the WAF/reverse proxy.
   • Run the Fireshare service as an unprivileged, low-privilege user in a hardened, read-only container with a restricted filesystem (--read-only, no privileged mode, minimal bind mounts) to limit the impact of an arbitrary file write.
   • Enable file-integrity monitoring on the host and application volume to detect unexpected writes/overwrites.
   • Deploy the Suricata/Sigma/Wazuh detections above in monitor/alert mode.

2. Patch / upgrade steps:

   • Upgrade Fireshare to 1.6.14 (per OSV) or later. Because the patch claim is unconfirmed, validate by checking the project's repository/advisory for the corresponding release. Verify the running version after upgrade.
   • Rebuild/restart containers from the updated image; confirm the served version string reflects the fix.

3. Long-term hardening:

   • Never invoke shell or external binaries with concatenated untrusted strings; use structured argument arrays / allowlists for media tooling, and reject values containing argument-delimiter characters.
   • Enforce strict Content-Disposition filename handling and normalize uploaded file names.
   • Apply least privilege and mandatory access control; constrain file paths written by the media pipeline to a dedicated, non-system directory.
   • Maintain a vulnerability-management process for self-hosted apps; track OSV/GitHub advisories for Fireshare and similar media servers.

References

• NVD — CVE-2026-54337: https://nvd.nist.gov/vuln/detail/CVE-2026-54337
• CWE-88 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): https://cwe.mitre.org/data/definitions/88.html
• OSV entry (single-source patch claim, Fireshare 1.6.14): https://osv.dev/ (search CVE-2026-54337)
• Fireshare project repository / release notes (verify 1.6.14 fix): consult the official Fireshare GitHub releases page
• FIRST.org EPSS: not yet scored as of this report — no exploit-prediction value available

Exploitation status: No public PoC, no Nuclei template, no exploit code, and not listed in CISA KEV. No threat-actor campaign or in-the-wild exploitation evidence is available at this time. Despite the absence of public tooling, the unauthenticated, network-reachable nature and 9.8 severity warrant treating exposed instances as high priority for patching or edge authentication