VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Dec 12, 2025· Updated Jun 17, 2026

CVE-2025-67728

CVE-2025-67728

Description

Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file. The malicious filename is then concatenated directly into a shell command, which can be used for uploading files to arbitrary directories via path traversal, or executing system commands for Remote Code Execution (RCE). This issue is fixed in version 1.3.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Shaneisrael/Fireshare3 versions
    cpe:2.3:a:shaneisrael:fireshare:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:shaneisrael:fireshare:*:*:*:*:*:*:*:*range: <1.3.0
    • (no CPE)range: <=1.2.30
    • (no CPE)range: < 1.3.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.