---
id: CVE-2026-54544
title: Fireshare facilitates self-hosted media and link sharing
summary: >-
  Fireshare facilitates self-hosted media and link sharing. Prior to version
  1.6.16, two API endpoints that trigger outbound HTTP requests are missing the
  @login_required decorator. An unauthenticated attacker can call POST
  /api/test-disco…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L'
cwe:
  - CWE-918
vendor: ShaneIsrael
product: fireshare
affected:
  - fireshare < 1.6.16
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:17:25.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54544'
references:
  - url: >-
      https://github.com/ShaneIsrael/fireshare/commit/3d786848d2d27344d4cdecf1bd0d54294c6ca160
    label: security-advisories@github.com
  - url: >-
      https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-w7j7-gv7f-gj92
    label: security-advisories@github.com
  - url: >-
      https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-w7j7-gv7f-gj92
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-16T19:19:22.909237Z'
ingestedAt: '2026-09-15T20:44:02.615Z'
epss: 0.0032
epssPercentile: 0.25243
---

## Overview

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login_required decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare server to issue an arbitrary HTTP POST to any URL the attacker supplies, including internal network addresses and cloud metadata services. No credentials, session cookies, or prior access are required. Version 1.6.16 contains a patch.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.