CVE-2026-54544: Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @loginrequired decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare server to issue an arbitrary HTTP POST to any URL the attacker supplies, including internal network addresses and cloud metadata services. No credentials, session cookies, or prior access are required. Version 1.6.16 contains a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fireshareto a version that resolves this vulnerability.Fixed in 1.6.16 - Configuration
Ensure @login_required is applied to both POST /api/test-discord-webhook and POST /api/test-webhook (prior to version 1.6.16 these endpoints were missing login_required).
Fireshare webhook test endpoints @login_required decorator = required
Event History
Frequently Asked Questions
Which deployments are exposed?
Fireshare deployments running a version prior to 1.6.16 are exposed if an attacker can reach the affected API endpoints over the network. The issue does not require credentials, session cookies, or prior access.
What does an attacker need to exploit this issue?
An attacker only needs to send a POST request to /api/test-discord-webhook or /api/test-webhook and provide a target URL. The Fireshare server will then issue an HTTP POST to that URL, including to internal addresses or cloud metadata services.
How can I tell whether my instance is affected?
Instances running a Fireshare version earlier than 1.6.16 are affected. The vulnerable behavior is associated with the two webhook test endpoints lacking login protection.
What is the remediation?
Upgrade Fireshare to version 1.6.16, which contains the patch.