CVE-2026-54706 OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
Attackers can read local files outside the shared directory via symlink traversal in OnionShare's file sharing modes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54706?
CVE-2026-54706 is a medium-severity path traversal vulnerability in onionshare, published on 31 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.
Weakness: CWE-59
Which versions are affected by CVE-2026-54706?
3 open source packages ship an affected version, including onionshare-cli.
| Package | Affected | Fixed in |
|---|---|---|
onionshare-cli PyPI | All versions | 2.6.4 |
onionshare-cli PyPI | All versions | 2.6.4 |
onionshare-cli PyPI | All versions | 2.6.4 |
How do I fix CVE-2026-54706?
Upgrade onionshare-cli to 2.6.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54706 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54706 exists.
Sources
Also known as DEBIAN-CVE-2026-54706, GHSA-22p9-r2f5-22mf, PYSEC-2026-3585, UBUNTU-CVE-2026-54706.