CVE-2026-54707CWE-863broken-access-control

CVE-2026-54707

Medium · published July 31, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
33.1
In the wild
Unconfirmed
What it is

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00400 · 33.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-31T21:16Z
References (4)
https://github.com/onionshare/onionshare/commit/a090e97193efc91fbeac9dace7793ea568b83cf5 · [email protected]https://github.com/onionshare/onionshare/releases/tag/v2.6.4 · [email protected]https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp · [email protected]https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 31 JUL 16:28Z
    OnionShare Receive mode writes uploaded files even when file uploads are disabled
    cvelistv5