Remote Code Execution Vulnerability in Fireshare Media Sharing by Shane Israel

CVE-2025-67728

What is CVE-2025-67728?

Fireshare, a platform for self-hosted media and link sharing, contains a vulnerability that allows an attacker to exploit filename handling during file uploads. Versions 1.2.30 and earlier permit authenticated users, or unauthenticated users with Public Uploads enabled, to upload files with malicious filenames. These filenames can be manipulated to execute arbitrary commands through shell command concatenation, resulting in potential remote code execution. This security issue has been rectified in version 1.3.0.

References