CVE-2026-54707: OnionShare Receive mode writes uploaded files even when file uploads are disabled

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-31 · updated 2026-09-10
Weakness: CWE-863

Description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

Affected products

onionshare: before 2.6.4

References

https://github.com/onionshare/onionshare/commit/a090e97193efc91fbeac9dace7793ea568b83cf5
https://github.com/onionshare/onionshare/releases/tag/v2.6.4
https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp
https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp

Get alerted when CVE-2026-54707 or the next vulnerability affects your stack