CVE-2026-54706

Published: Jul 31, 2026Modified: Jul 31, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (4)

https://github.com/onionshare/onionshare/commit/48f31cfac077fcc9c04c67c2a6dbf87d956f5eec

Source: security-advisories@github.com

https://github.com/onionshare/onionshare/releases/tag/v2.6.4

Source: security-advisories@github.com

https://github.com/onionshare/onionshare/security/advisories/GHSA-22p9-r2f5-22mf

Source: security-advisories@github.com

https://github.com/onionshare/onionshare/security/advisories/GHSA-22p9-r2f5-22mf

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.