Vulnerability · Published Jul 31, 2026 · Assigned by GitHub_M
CVE-2026-54706OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
Medium 4.8
In plain English
A medium-severity security flaw in onionshare from onionshare. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | onionshare | no fix listed | DEBIAN-CVE-2026-54706 |
| Debian:13 | onionshare | 2.6.3-1+deb13u2 | DEBIAN-CVE-2026-54706 |
| Debian:14 | onionshare | 2.6.4-1 | DEBIAN-CVE-2026-54706 |
| PyPI | onionshare-cli | 2.6.4 | PYSEC-2026-3585 |
| PyPI | onionshare-cli | 2.6.4 | GHSA-22p9-r2f5-22mf |
| Ubuntu:24.04:LTS | onionshare | no fix listed | UBUNTU-CVE-2026-54706 |
| Ubuntu:26.04:LTS | onionshare | no fix listed | UBUNTU-CVE-2026-54706 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| onionshare | onionshare | < 2.6.4 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N