Medium severity4.8NVD Advisory· Published Jul 31, 2026· Updated Jul 31, 2026

CVE-2026-54706

Description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Onionshare/Onionsharellm-fuzzy
Range: <2.6.4
osv-coords
pkg:rpm/opensuse/python-onionshare&distro=openSUSE%20Tumbleweed
Range: < 2.6.4-1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-22p9-r2f5-22mfghsaADVISORY
github.com/onionshare/onionshare/commit/48f31cfac077fcc9c04c67c2a6dbf87d956f5eecnvd
github.com/onionshare/onionshare/releases/tag/v2.6.4nvd
github.com/onionshare/onionshare/security/advisories/GHSA-22p9-r2f5-22mfnvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000