Fireshare includes an unauthenticated endpoint at /api/uploadChunked/public that, due to improper validation of the checkSum parameter, allows an attacker to supply an arbitrary file path. This flaw is a classic path‑traversal weakness (CWE‑22) that enables the creation or overwrite of any file the web server process can write to, thereby facilitating arbitrary file write. An attacker can place malicious scripts, alter configuration files, or replace application assets, potentially leading to remote code execution or significant data integrity violations.

The vulnerability affects Fireshare deployments built by ShaneIsrael running any version earlier than 1.5.3. Versions 1.5.3 and later include the patch that disables the vulnerable behavior for the public upload endpoint.

The CVSS base score of 9.1 reflects a highly severe risk. Exploitation requires no authentication and only a simple HTTP request to the exposed public endpoint, making the attack straightforward for any network‑reachable attacker. While EPSS data is not available, the absence of a CISA KEV listing does not reduce the potential impact. If the attacker can reach the API, the ability to write arbitrary files poses a severe threat to confidentiality, integrity, and availability of the affected system.