Executive brief
OnionShare is a tool used for secure and anonymous file sharing and communication over the Tor network. A vulnerability was discovered where the "Receive" mode fails to properly block file uploads even when the user has explicitly disabled that feature to only allow text messages. An attacker who has access to the OnionShare address can bypass the user interface restrictions to upload files, potentially filling up the recipient's disk space or placing unwanted files on their system.
Technical details
The vulnerability exists in the Receive mode request-streaming implementation within `cli/onionshare_cli/web/receive_mode.py`. While the user interface hides the file input when `disable_files` is enabled, the backend `ReceiveModeRequest._get_file_stream()` method does not check this setting before creating a writable file stream. An attacker can bypass the UI by sending a crafted multipart POST request containing `file[]` data to the `/upload` or `/upload-ajax` endpoints. The application then writes the uploaded bytes to the configured receive directory before any route-level authorization checks occur. This issue is fixed in version 2.6.4 by ensuring the file stream sink respects the file-disable policy.
Affected products
- OnionShare OnionShare CLI/Desktop < 2.6.4
Timeline
- 2026-05-30: patched: Fix committed to repository
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date