CVE-2026-54706
Received Received - Intake

Symbolic Link Following in OnionShare CLI/Desktop

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-54706
EUVD
EUVD-2026-51571

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
micahflee onionshare 2.6.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OnionShare before 2.6.4 has a vulnerability where it follows symbolic links in the CLI and Desktop versions. This allows remote users in Share or Website mode to access files outside the intended directory by exploiting symbolic links.

Detection Guidance

This vulnerability can be detected by checking the OnionShare version installed on your system. If you are running a version prior to 2.6.4, your system is vulnerable. Run 'onionshare --version' to check the installed version.

Impact Analysis

If you use OnionShare versions before 2.6.4, an attacker could trick you into sharing sensitive files outside your selected directory. This could lead to unauthorized access to local files on your system.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating GDPR (data protection) and HIPAA (health information privacy) by allowing access to restricted files.

Mitigation Strategies

Upgrade OnionShare to version 2.6.4 or later immediately. This can typically be done using your package manager, such as 'pip install --upgrade onionshare' or following the official installation instructions for your operating system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart