Summary

An authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write files outside the intended upload directory by supplying a crafted checkSum value. This can lead to arbitrary file creation in attacker-chosen writable locations, violating filesystem integrity and potentially enabling further compromise depending on the deployment.

Details

The issue is present in Fireshare’s chunked upload handler:

• app/server/fireshare/api.py
• Route: /api/uploadChunked

The handler accepts multipart form fields including checkSum, then uses that value directly to construct filesystem paths for chunk storage:

checkSum = request.form.get('checkSum')
tempPath = os.path.join(upload_directory, f"{checkSum}.part{chunkPart:04d}")
with open(tempPath, 'wb') as f:
    f.write(blob.read())

Relevant references:

• app/server/fireshare/api.py:1525-1613 — full handler
• app/server/fireshare/api.py:1563-1567 — file write sink
• app/server/fireshare/api.py:1571-1573, 1592-1593 — subsequent path usage during re-read and reassembly

The root cause is that checkSum is fully attacker-controlled and is incorporated into file paths without sanitization or containment checks. In particular:

• no normalization is applied to remove traversal sequences
• no canonical path validation is performed
• no verification ensures the resolved path remains within upload_directory

Because of this, path traversal sequences in checkSum can escape the intended upload directory and cause chunk files to be written to arbitrary filesystem locations writable by the Fireshare process.

Impact

• Type: Path traversal leading to arbitrary file write
• Who is impacted: Authenticated users of Fireshare deployments where the upload feature is enabled
• Security impact: An attacker can create files outside the intended upload directory in arbitrary writable locations, which may enable data corruption, local persistence, or other follow-on attacks depending on the environment
• Attack preconditions: Valid authenticated access is required