Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-54544Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints

High 7.2

In plain English

A high-severity server-side request forgery in fireshare from ShaneIsrael. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.4%top 64.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login_required decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare server to issue an arbitrary HTTP POST to any URL the attacker supplies, including internal network addresses and cloud metadata services. No credentials, session cookies, or prior access are required. Version 1.6.16 contains a patch.

Affected products (as reported)

Vendor	Product	Versions
ShaneIsrael	fireshare	< 1.6.16

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

References

https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-w7j7-gv7f-gj92 x_refsource_CONFIRM
https://github.com/ShaneIsrael/fireshare/commit/3d786848d2d27344d4cdecf1bd0d54294c6ca160 x_refsource_MISC