Fireshare, a self‑hosted media sharing application, contains two API endpoints that trigger outbound HTTP POST requests. Prior to version 1.6.16 these endpoints lack the required authentication guard, allowing an unauthenticated caller to provide any URL. The server then makes an HTTP POST to that URL, enabling the attacker to send data to arbitrary external or internal services, including cloud metadata endpoints. This results in an SSRF vulnerability that can expose internal resources or be leveraged for further attacks, such as credential harvesting or internal network scanning.

Affected versions are all releases of Fireshare older than 1.6.16, distributed by the vendor ShaneIsrael. The vulnerable API paths are POST /api/test-discord-webhook and POST /api/test-webhook, which are public and do not require login.

The CVSS score of 7.2 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in CISA KEV. Exfiltration is possible by any external actor with network access to the Fireshare instance; no credentials or session are required, so the threat vector is a simple unauthenticated remote request to the public API.