CVE-2026-54706
Medium · 4.8CVSS
4.8
EPSS
0.3%
Published
Jul 31, 2026
CISA due date
—
The record
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-onionshare | 0 | 2.6.4-1.1 |
Related vulnerabilities
- CVE-2026-54707 OnionShare is an open source tool that lets you securely and anonymously share files… Also affects python-onionshare
- CVE-2022-21693 OnionShare is an open source tool that lets you securely and anonymously share files… Also affects python-onionshare
- CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
- CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
- CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59
- CVE-2026-105081 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for… CWE-59