CVE-2026-54706

MediumCVSS 4.8

Published: 31/07/2026(UTC)Updated: 10/09/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

OnionShare prior to 2.6.4 follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.

Risk Assessment

The risk is the possibility of unauthorized reading of files from the server's filesystem, which could lead to leakage of sensitive data.

Recommendation

It is recommended to upgrade to version 2.6.4 or later.

Other vulnerabilities in OnionShare

CVE-2026-54707Medium
OnionShare prior to 2.6.4 does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

Original NVD description (English source)

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS