CVE-2026-54707 – OnionShare Receive mode writes uploaded files even when file uploads are disabled

CVE ID :CVE-2026-54707

Published : July 31, 2026, 5:16 p.m. | 30 minutes ago

Description :OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

Severity: 5.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…