CVE-2026-54707

MediumCVSS 5.4

Published: 31/07/2026(UTC)Updated: 10/09/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

OnionShare prior to 2.6.4 does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

Risk Assessment

The risk is that users can upload files despite the text-only restriction, potentially leading to unauthorized data storage on the server.

Recommendation

It is recommended to upgrade to version 2.6.4 or later.

Other vulnerabilities in OnionShare

CVE-2026-54706Medium
OnionShare prior to 2.6.4 follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.

Original NVD description (English source)

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS