CVE-2026-54706: OnionShare CLI/ Desktop 2.6.3 Symlink Vulnerability Leading to Local File Disclosure
Summary
CVE-2026-54706: OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files. Affects onionshare-cli versions < 2.6.4. Fixed in 2.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OnionShare is an open-source tool that allows users to share files, host websites, and chat securely over the Tor network. The application is designed to facilitate anonymous sharing without the need for a central server. The impacted version, 2.6.3, has a critical flaw that allows it to follow symbolic links in shared directories, potentially exposing sensitive local files to unauthorized users.
Vulnerability Detail
OnionShare CLI/Desktop 2.6.3 contains a vulnerability that allows the application to follow symbolic links within shared directories. This flaw can lead to unintended disclosure of local files, as a remote recipient can access files outside the intended directory if it contains symlinks pointing to sensitive locations. The vulnerability arises from the use of os.path.isfile(), which follows symlinks, and the lack of checks to prevent symlink traversal. This could result in the exposure of sensitive data such as SSH keys, browser profiles, and other confidential information.
How To Fix
Latest published version: 2.7.0 as of 22 Oct 2026
pip install --upgrade "onionshare-cli==2.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.4
This is the first release that contains the fix.
pip install --upgrade "onionshare-cli==2.6.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid sharing directories that contain symbolic links. Additionally, users can manually check shared directories for symlinks and remove them before initiating a share.
Conclusion
The vulnerability identified as CVE-2026-54706 in OnionShare CLI/Desktop 2.6.3 poses a significant risk by allowing symlink traversal, which can lead to the exposure of sensitive local files. Users are strongly advised to update to version 2.6.4 or later to mitigate this risk. Additionally, temporary workarounds should be employed until the update can be applied.
See every vulnerability recorded for onionshare-cli →
FAQ
The vulnerability allows OnionShare to follow symlinks in shared directories, potentially exposing sensitive local files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files such as SSH keys, browser profiles, and other confidential information that the OnionShare process can read.
Yes, the vulnerability has been patched in version 2.6.4 of OnionShare. Users should update to this version to mitigate the risk.
If you cannot update immediately, avoid sharing directories that contain symlinks and manually check for and remove any symlinks before sharing.
References
Related vulnerabilities
Recent vulnerabilities recorded for onionshare-cli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
