VDB
CVE-2026-54707
CVE-2026-54707
PUBLISHED
CVSS 5.4 MEDIUM
Reported by GitHub_M · Published July 31, 2026
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
Risk Scores
CVSS 3.1
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| onionshare | onionshare | < 2.6.4 |
| onionshare | onionshare | < 2.6.4 |
Timeline
- Jul 1, 2026 CVE Published
- Aug 1, 2026 Coalition ESS Score
- Aug 2, 2026 EPSS Score
- Aug 4, 2026 CVE Updated
- Aug 7, 2026 EPSS Score
- Aug 7, 2026 Security Advisory