CVE-2022-21693: Open Source Vulnerability in OnionShare
Summary
CVE-2022-21693: OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affects onionshare-cli versions < 2.5. Fixed in 2.5. How to fix ↓
Also tracked for
- onionshare · Debian:12
The same CVE-2022-21693 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OnionShare is an open source tool that utilizes the Tor network to securely and anonymously share files, host websites, and chat with friends. It provides a means for users to share sensitive data while maintaining their privacy. However, in certain versions of OnionShare, there exists a vulnerability that allows an adversary with filesystem access from the context of the Onionshare process to access sensitive files in the entire user home folder. Although hidden folders are automatically excluded, this vulnerability still poses a risk of leaking sensitive data. The impact of this vulnerability can be reduced by using the flatpak release of OnionShare.
Vulnerability Detail
The vulnerability in OnionShare arises from the ability of an adversary to gain filesystem access from the context of the Onionshare process. This access allows them to potentially access sensitive files in the user home folder, leading to the potential leakage of sensitive data. It is important to note that hidden folders are automatically excluded, which mitigates the impact to some extent. However, if an adversary can exploit this vulnerability, they can gain unauthorized access to sensitive information stored in the user home folder.
How To Fix
Latest published version: 2.7.0 as of 22 Oct 2026
pip install --upgrade "onionshare-cli==2.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5
This is the first release that contains the fix.
pip install --upgrade "onionshare-cli==2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can utilize the flatpak release of OnionShare. The flatpak release provides additional security measures that mitigate the impact of this vulnerability. By using the flatpak release, users can reduce the risk of sensitive data leakage.
Conclusion
In conclusion, OnionShare is an open source tool that allows secure and anonymous file sharing, website hosting, and chat. However, certain versions of OnionShare are vulnerable to a filesystem access vulnerability that can lead to the unauthorized access and potential leakage of sensitive data. To mitigate this vulnerability, it is recommended to update to the latest version of OnionShare or use the flatpak release. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for onionshare-cli →
FAQ
OnionShare is an open source tool that enables secure and anonymous file sharing, website hosting, and chat using the Tor network.
The vulnerability allows an adversary to access sensitive files in the user home folder, potentially leading to the leakage of sensitive data.
The impact of this vulnerability can be reduced by using the flatpak release of OnionShare.
To fix this vulnerability, update OnionShare to version 2.5 or later.
Yes, users can utilize the flatpak release of OnionShare as a workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for onionshare-cli.
