Vulnerability · Published Jul 31, 2026 · Assigned by GitHub_M
CVE-2026-54707OnionShare Receive mode writes uploaded files even when file uploads are disabled
Medium 5.4
In plain English
A medium-severity incorrect authorization in onionshare from onionshare. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | onionshare | no fix listed | DEBIAN-CVE-2026-54707 |
| Debian:13 | onionshare | 2.6.3-1+deb13u2 | DEBIAN-CVE-2026-54707 |
| Debian:14 | onionshare | 2.6.4-1 | DEBIAN-CVE-2026-54707 |
| PyPI | onionshare-cli | 2.6.4 | PYSEC-2026-3586 |
| PyPI | onionshare-cli | 2.6.4 | GHSA-v833-3823-cmhp |
| Ubuntu:24.04:LTS | onionshare | no fix listed | UBUNTU-CVE-2026-54707 |
| Ubuntu:26.04:LTS | onionshare | no fix listed | UBUNTU-CVE-2026-54707 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| onionshare | onionshare | < 2.6.4 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L