Onionshare
Approved changes feed: RSS · Atom
cpe:2.3:a:onionshare:onionshare:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Onionshare (83fd1960-ad0d-56d8-b978-5718701571f7) |
|---|---|
| Product | Onionshare (c33e9129-f3d0-5191-aae8-9ab59085db5d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/onionshare |
purl2cpe | 2026-06-01 10:17:42.092730 |
pkg:deb/ubuntu/onionshare |
purl2cpe | 2026-06-01 10:17:42.092733 |
pkg:github/onionshare/onionshare |
purl2cpe | 2026-06-01 10:17:42.092736 |
pkg:rpm/fedora/onionshare |
purl2cpe | 2026-06-01 10:17:42.092739 |
pkg:rpm/opensuse/onionshare |
purl2cpe | 2026-06-01 10:17:42.092742 |
pkg:sourceforge/onionshare.mirror |
purl2cpe | 2026-06-01 10:17:42.092745 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54706 |
vulnerable | 2026-09-16 04:33:28.658920 |
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
MEDIUM (4.8)
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.
Published: 2026-07-31T16:30:58.062Z
Updated: 2026-07-31T19:00:44.128Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54707 |
vulnerable | 2026-09-16 04:33:28.587834 |
OnionShare Receive mode writes uploaded files even when file uploads are disabled
MEDIUM (5.4)
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
Published: 2026-07-31T16:28:06.628Z
Updated: 2026-07-31T23:28:15.094Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21696 |
vulnerable | 2026-06-08 05:40:02.010022 |
Username spoofing in OnionShare
MEDIUM (4.3)
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
Published: 2022-01-18T19:55:10.000Z
Updated: 2025-04-23T19:11:08.548Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21695 |
vulnerable | 2026-06-08 05:40:02.009469 |
Improper Access Control in Onionshare
MEDIUM (4.3)
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.
Published: 2022-01-18T21:55:10.000Z
Updated: 2025-04-23T19:10:47.718Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21694 |
vulnerable | 2026-06-08 05:40:02.009045 |
OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website
LOW (3.7)
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.
Published: 2022-01-18T22:20:10.000Z
Updated: 2025-04-23T19:10:18.217Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21693 |
vulnerable | 2026-06-08 05:40:02.008594 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21692 |
vulnerable | 2026-06-08 05:40:02.008171 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21691 |
vulnerable | 2026-06-08 05:40:02.007729 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21690 |
vulnerable | 2026-06-08 05:40:02.007293 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21689 |
vulnerable | 2026-06-08 05:40:02.006826 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21688 |
vulnerable | 2026-06-08 05:40:02.006298 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41868 |
vulnerable | 2026-06-08 05:35:21.214175 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41867 |
vulnerable | 2026-06-08 05:35:21.213479 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19960 |
vulnerable | 2026-06-08 05:11:16.480534 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-5026 |
vulnerable | 2026-06-08 05:07:56.186216 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.