CVE-2026-54707 in OnionShare
Summary
by MITRE • 07/31/2026
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
OnionShare represents a significant security tool within the open source ecosystem designed to facilitate secure and anonymous file sharing, website hosting, and instant messaging through the Tor network infrastructure. The application serves as a bridge between traditional file transfer protocols and privacy-focused communication methods, leveraging the anonymity provided by the Tor network to protect user identities during data exchanges. This tool has gained substantial traction among privacy-conscious individuals, journalists, activists, and security researchers who require secure communication channels without exposing their network locations or personal information.
The vulnerability identified in versions prior to 2.6.4 stems from a critical flaw in the receive mode implementation within the OnionShare CLI and desktop applications. Specifically, the system fails to properly enforce the disable_files setting that should restrict operations to text-only communications when configured by users. This technical oversight creates a dangerous discrepancy between user intent and actual application behavior, where the ReceiveModeRequest._get_file_stream() function continues to process and write multipart file[] data to disk regardless of the text-only mode configuration. The vulnerability manifests as an improper validation mechanism that bypasses the intended security controls, allowing potentially harmful file transfers to occur even when users have explicitly disabled file receiving capabilities.
The operational impact of this vulnerability extends beyond simple functionality breaches, creating potential security risks for users who rely on OnionShare for sensitive communications. When users configure the application in text-only receive mode, they expect that no files will be accepted or stored on their local systems, yet the flaw enables automatic file writing to disk without proper authorization checks. This behavior could expose users to various attack vectors including malware distribution, unauthorized data collection, and potential compromise of the local system through malicious file uploads. The vulnerability particularly affects users who may be operating in high-risk environments where maintaining strict communication boundaries is essential for operational security.
This specific vulnerability aligns with CWE-691, which addresses inadequate enforcement of security controls and improper validation of user inputs. The flaw demonstrates a clear failure in input sanitization and privilege management within the application's receive mode implementation. From an attack perspective, this issue maps to several ATT&CK techniques including T1059 for command and scripting interpreter usage, T1566 for malicious file execution, and T1071 for application layer protocol usage. The vulnerability essentially creates a backdoor pathway that allows unauthorized file processing even when security controls are explicitly configured to prevent such operations.
The remediation implemented in version 2.6.4 addresses the core validation issue by ensuring proper enforcement of the disable_files setting throughout the receive mode functionality. This fix requires comprehensive input validation at the request processing level, implementing strict checks before any file operations are initiated. The updated implementation must verify the current mode configuration and reject file upload attempts when text-only mode is enabled, thereby aligning the application behavior with user expectations and security configurations. System administrators and security teams should prioritize updating to version 2.6.4 or later to eliminate this potential attack vector and maintain proper operational security standards within their environments.