TI-2026-39522 Aliases CVE-2026-54706 GHSA-22p9-r2f5-22mf

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

MEDIUM 55CWE-59Published 2026-07-31 · Updated 2026-07-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-59 and the CVSS impact.

Summary

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00344 28th percentileScored 2026-11-07

Fix Fixed onionshare (onionshare): 2.6.4onionshare-cli (PyPI): 2.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
onionshare	onionshare	before 2.6.4	2.6.4	Patch available	CNA
—	onionshare-cli (PyPI)	before 2.6.4	2.6.4	Patch available	GHSA-22p9-r2f5-22mf

onionshare Vendoronionshare Affected before 2.6.4 Fixed in 2.6.4 Patch available CNA
onionshare-cli (PyPI) Vendor— Affected before 2.6.4 Fixed in 2.6.4 Patch available GHSA-22p9-r2f5-22mf

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:onionshare:onionshare::::::::	—	—	onionshare

cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:* Versions — — ·onionshare

Remediation

Fix · CNA onionshare (onionshare) Fixed in 2.6.4
Fix · GHSA-22p9-r2f5-22mf onionshare-cli (PyPI) Fixed in 2.6.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-54706
2026-10-03 Alias added: GHSA-22p9-r2f5-22mf

References

Other 4

TI-2022-06066 Cross-Site Scripting in Onionshare CVSS 3.1HIGH 8.7
TI-2026-39523 OnionShare Receive mode writes uploaded files even when file uploads are disabled CVSS 3.1MEDIUM 5.4
TI-2022-06068 Improper Access Control in Onionshare CVSS 3.1MEDIUM 4.3
TI-2021-18479 OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a… CVSS 3.1CRITICAL 9.8
TI-2022-06065 Denial of Service in Onionshare CVSS 3.1HIGH 7.5
TI-2022-06064 Out-of-bounds Read in Onionshare CVSS 3.1HIGH 7.5

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences