An unauthenticated argument injection vulnerability in ShaneIsrael fireshare allows remote attackers to overwrite system files, posing a critical risk of full system compromise.

This is an argument injection vulnerability (CWE-88) residing in the video upload function. The flaw permits an unauthenticated attacker to manipulate system arguments, resulting in the ability to write or overwrite arbitrary files on the host system.

The ability for an unauthenticated user to overwrite system files carries a CVSS score of 9.8, indicating a critical risk of remote code execution or complete system takeover. Successful exploitation could lead to total loss of confidentiality, integrity, and availability of the affected media server and any data stored within the environment.

Immediate Action: Upgrade ShaneIsrael fireshare to version 1.6.14 or later immediately to apply the patch provided by the vendor.

Proactive Monitoring: Inspect system logs for unusual file write operations, particularly those originating from the video upload directory or targeting system configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious injection patterns in HTTP requests directed at the media upload endpoint.

Public Exploit Available: Yes, a public proof-of-concept repository is available via GitHub (https://github.com/4qu4r1um/CVE-2026-54337-PoC).

Given the critical severity and the ease of exploitation, organizations running Fireshare must prioritize this update. Administrators should verify their current version and apply the 1.6.14 patch without delay to prevent potential system-level compromise from unauthenticated remote attackers.