CVE-2026-54707: OnionShare CLI/ Desktop 2.6.3 Vulnerability in File Upload Handling
Summary
CVE-2026-54707: OnionShare Receive mode writes uploaded files even when file uploads are disabled. Affects onionshare-cli versions < 2.6.4. Fixed in 2.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OnionShare is an open-source tool that allows users to share files and host anonymous chat services over the Tor network. It provides a unique way to share files securely and anonymously, making it popular among privacy-conscious users. The application has both a command-line interface (CLI) and a desktop version, both of which utilize the same underlying codebase. However, a vulnerability in version 2.6.3 has been identified that affects its file upload handling, specifically in the Receive mode.
Vulnerability Detail
OnionShare CLI/Desktop 2.6.3 does not properly enforce the 'disable_files' setting in Receive mode, allowing remote users to upload files even when file uploads are disabled. This occurs because the application writes uploaded files to disk before it checks the settings, leading to potential unwanted file placement and disk consumption. The vulnerability arises from the mishandling of multipart requests, where the application processes file uploads without respecting the user's configuration to disable such uploads. This could lead to unauthorized file storage on the server, posing a risk to the system's integrity and privacy.
How To Fix
Latest published version: 2.7.0 as of 22 Oct 2026
pip install --upgrade "onionshare-cli==2.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.4
This is the first release that contains the fix.
pip install --upgrade "onionshare-cli==2.6.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the Receive mode with file uploads disabled until they can update to the patched version. Additionally, users should monitor their OnionShare data directories for any unexpected files and remove them if necessary.
Conclusion
The vulnerability identified in OnionShare CLI/Desktop 2.6.3 allows unauthorized file uploads despite user settings to disable such functionality. Users are advised to update to version 2.6.4 or later to mitigate this risk. Until then, it is crucial to monitor for any unexpected files and avoid using the affected features.
See every vulnerability recorded for onionshare-cli →
FAQ
The vulnerability allows unauthorized file uploads even when the user has configured the service to reject file uploads, potentially leading to unwanted file storage and disk consumption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, avoid using the Receive mode with file uploads disabled and monitor your data directories for any unauthorized files.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
You can find more information about OnionShare on its official GitHub repository or its website, which provides documentation and usage instructions.
References
Related vulnerabilities
Recent vulnerabilities recorded for onionshare-cli.
