CVE-2026-54707
Medium · 5.4CVSS
5.4
EPSS
0.4%
Published
Jul 31, 2026
CISA due date
—
The record
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-onionshare | 0 | 2.6.4-1.1 |
Related vulnerabilities
- CVE-2026-54706 OnionShare is an open source tool that lets you securely and anonymously share files… Also affects python-onionshare
- CVE-2022-21693 OnionShare is an open source tool that lets you securely and anonymously share files… Also affects python-onionshare
- CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
- CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863
- CVE-2026-96373 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96356 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863