CVE-2026-54707 Details
Description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
A vulnerability exists in OnionShare CLI/Desktop versions prior to 2.6.4, allowing files to be uploaded and saved to disk even when file uploads are disabled in the Receive mode settings. This issue arises because the application does not properly enforce the 'disable_files' setting at the file upload processing stage. Instead, files can be sent through a multipart request and will be written to the receive data directory, bypassing the intended restriction. The vulnerability affects both the command-line interface and the desktop application, as they share the same web handling code for receive mode.
Users can update to OnionShare version 2.6.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/onionshare/onionshare/commit/a090e97193efc91fbeac9dace7793ea568b83cf5 | [email protected] | Source CodeVendor |
| https://github.com/onionshare/onionshare/releases/tag/v2.6.4 | [email protected] | Release NotesVendor |
| https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OnionShare | 2.6.3 (semver) |
CPE
Remediation
| |
| OnionShare CLI | 2.6.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 1, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |