Attack Chain

1. Attacker authenticates to the Fireshare application.
2. Attacker initiates a chunked file upload to the vulnerable endpoint.
3. Attacker crafts a malicious HTTP POST request with a checkSum multipart field containing a path traversal payload (e.g., ../../../tmp/evil.sh).
4. The Fireshare server processes the request and constructs the file path using the unsanitized checkSum value.
5. The server writes the uploaded chunk to the attacker-specified location (e.g., /tmp/evil.sh).
6. Attacker uploads the complete malicious file through subsequent chunked upload requests.
7. Attacker executes the uploaded file through other means, such as a web shell or command injection vulnerability (out of scope).
8. Attacker achieves arbitrary code execution on the server, potentially leading to privilege escalation or data exfiltration.

Impact

Successful exploitation of this path traversal vulnerability (CVE-2026-33645) in Fireshare 1.5.1 allows attackers to write arbitrary files to sensitive locations. This could lead to complete compromise of the Fireshare instance, including the ability to execute arbitrary code. Depending on the deployment environment (e.g., containerized), this may also lead to host compromise. Without specific figures, the potential number of affected installations depends on the adoption rate of Fireshare 1.5.1 before patching.

Recommendation

• Upgrade Fireshare installations to version 1.5.2 or later to remediate CVE-2026-33645.
• Implement the provided Sigma rule Fireshare Suspicious File Upload Path to detect attempts to exploit this vulnerability via web server logs.
• Monitor web server logs for POST requests to the chunked upload endpoint with suspicious path traversal sequences in the cs-uri-query field using the same Sigma rule.