CVE-2026-54707
Received Received - Intake

OnionShare CLI/Desktop Receives Files Despite Disabled Setting

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-54707
EUVD
EUVD-2026-51570

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
micahflee onionshare to 2.6.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OnionShare before version 2.6.4 has a vulnerability in its Receive mode where the disable_files setting is not enforced. This allows multipart file data to be written to disk even when the application is configured to only accept text files.

Detection Guidance

This vulnerability affects OnionShare versions prior to 2.6.4 where the Receive mode disable_files setting is not enforced. To detect it, check your OnionShare version with 'onionshare --version' or 'pip show onionshare'. If the version is below 2.6.4, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker to bypass the intended file restriction and upload files to your system when you expect only text. This might lead to unauthorized file storage or potential malware delivery if combined with other exploits.

Mitigation Strategies

Upgrade OnionShare to version 2.6.4 or later immediately. Use 'pip install --upgrade onionshare' or download the latest release from the official repository. Ensure the disable_files setting is properly configured in Receive mode to prevent file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54707. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart