CVE-2022-21693

What it actually does

Path traversal flaw permits filesystem read access from the OnionShare process context to any non-hidden file within the entire user home directory.

Why it matters to the business

Attackers who already have limited code execution or file access inside the OnionShare process can obtain sensitive user documents and configuration files, increasing the chance of data exposure or follow-on compromise.

How an attack unfolds

An attacker who obtains a primitive allowing filesystem operations from within the running OnionShare process supplies crafted relative paths that bypass the intended directory restrictions and read arbitrary non-hidden files from the user's home folder.

How to fix it

Upgrade onionshare/onionshare (GIT) to commit 6642c25959f14daeb4a572798ccf4acd765d5795 or later; alternatively run the Flatpak release which isolates the application filesystem.

How to confirm the fix worked

Verify the installed commit hash or package version matches or exceeds the fixed revision; confirm that path traversal attempts outside the designated share directory are rejected.

Typical attack path

1. Obtain code execution or file-access primitive inside the OnionShare process
2. Construct path traversal sequences targeting non-hidden files
3. Read and exfiltrate sensitive documents or credentials from the home directory

How to detect it

Review process file-access logs and audit trails for OnionShare attempting to open paths containing sequences such as ../ that reach outside its designated share directory; look for reads of common sensitive files (ssh keys, browser profiles, documents) shortly after OnionShare startup.

What your security team should do

• Apply the referenced commit or switch to the Flatpak package immediately
• Audit any deployments where OnionShare runs with broad home-directory access
• Monitor for unexpected file reads originating from the OnionShare process