CVE-2026-54707: OnionShare incorrect authorization in Receive mode file upload sink

CVE-2026-54707 · Severity: medium · CVSS 5.4 · Published 2026-07-31

OnionShare is a tool used for secure and anonymous file sharing and communication over the Tor network. A vulnerability was discovered where the "Receive" mode fails to properly block file uploads even when the user has explicitly disabled that feature to only allow text messages. An attacker who has access to the OnionShare address can bypass the user interface restrictions to upload files, potentially filling up the recipient's disk space or placing unwanted files on their system.

Technologies: onionshare-cli (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54707 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54707 being exploited in the wild.
How severe is CVE-2026-54707?
Medium severity, with a CVSS score of 5.4, published 31 July 2026.
Which products and versions are affected?
OnionShare Desktop < 2.6.4; onionshare-cli (PyPI) < 2.6.4, ECOSYSTEM:introduced=0,fixed=2.6.4.
Is there a fix for CVE-2026-54707?
Yes. onionshare-cli (PyPI): upgrade to 2.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54707 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54707?
Check whether you run OnionShare Desktop or onionshare-cli (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • onionshare-cli (PyPI): upgrade to 2.6.4 or later
    pip install "onionshare-cli>=2.6.4"

Technical details

The vulnerability exists in the Receive mode request-streaming implementation within `cli/onionshare_cli/web/receive_mode.py`. While the user interface hides the file input when `disable_files` is enabled, the backend `ReceiveModeRequest._get_file_stream()` method does not check this setting before creating a writable file stream. An attacker can bypass the UI by sending a crafted multipart POST request containing `file[]` data to the `/upload` or `/upload-ajax` endpoints. The application then writes the uploaded bytes to the configured receive directory before any route-level authorization checks occur. This issue is fixed in version 2.6.4 by ensuring the file stream sink respects the file-disable policy.

Affected products

  • OnionShare OnionShare CLI/Desktop < 2.6.4

Identifiers

  • CVE-2026-54707
  • GHSA-v833-3823-cmhp
  • PYSEC-2026-3586

Timeline

  • 2026-05-30: patched: Fix committed to repository
  • 2026-06-09: advisory: GitHub Security Advisory published
  • 2026-07-31: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.