CVE-2022-21693: Path traversal vulnerability in Onionshare
Summary
CVE-2022-21693: Path traversal in Onionshare. Affects onionshare-cli versions >= 2.3, < 2.5. Fixed in 2.5. How to fix ↓
Also tracked for
- onionshare · Debian:12
The same CVE-2022-21693 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Onionshare is an open-source tool that allows users to securely and anonymously share files over the Tor network. It provides a simple and user-friendly interface for creating temporary onion services and sharing files with others. Onionshare is written in Python and is available as a command-line tool and as a Flatpak or Snap package for easy installation on various operating systems.
Vulnerability Detail
The path traversal vulnerability in Onionshare allows an attacker to access sensitive files in the user's home folder. This vulnerability arises from improper hardening of the filesystem restriction, which should only allow access to pre-defined subfolders. The Flatpak and Snap configurations of Onionshare allow read-only access to the entire home folder, including configuration files outside of the Onionshare-specific folders. While hidden folders are automatically excluded, an adversary with filesystem access from the context of the Onionshare process can still potentially leak sensitive data.
How To Fix
Latest published version: 2.7.0 as of 22 Oct 2026
pip install --upgrade "onionshare-cli==2.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5
This is the first release that contains the fix.
pip install --upgrade "onionshare-cli==2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually restrict access to sensitive files and folders in their home directory by adjusting the permissions or moving them to a different location. Additionally, users can consider using alternative file-sharing methods or tools until a fix is available for Onionshare.
Conclusion
The path traversal vulnerability in Onionshare can potentially lead to the unauthorized access and leakage of sensitive data. It is recommended to apply the necessary fixes and harden the filesystem restriction to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for onionshare-cli →
FAQ
Onionshare is an open-source tool that allows users to securely share files over the Tor network.
The vulnerability allows an attacker to access sensitive files in the user's home folder, potentially leading to the leakage of sensitive data.
To fix this vulnerability, the filesystem restriction in Onionshare should be hardened to only allow access to pre-defined folders. The Flatpak and Snap configurations should be modified accordingly.
Users can manually restrict access to sensitive files and folders in their home directory or consider using alternative file-sharing methods or tools.
Yes, the CVSS score for this vulnerability is 6.3.
Related vulnerabilities
Recent vulnerabilities recorded for onionshare-cli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
