- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 13 · 3 high, 7 medium, 1 low
- Registry
- PyPI
Advisories 13
- CVE-2026-54706Medium 4.8
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
Affected: fixed in 2.6.4.
- CVE-2026-54707Medium 5.4
OnionShare Receive mode writes uploaded files even when file uploads are disabled
Affected: fixed in 2.6.4.
- CVE-2022-21694Low 3.7
OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website
Affected: fixed in 2.5; from 2.2, fixed in 2.5.
- CVE-2022-21690High 8.7
Cross-Site Scripting in Onionshare
Affected: fixed in 2.5.
- CVE-2022-21692Medium 4.3
Improper Access Control in Onionshare
Affected: from 2.3, fixed in 2.5; fixed in 2.5.
- CVE-2022-21689High 7.5
Denial of Service in Onionshare
Affected: fixed in 2.5.
- CVE-2022-21693Medium 6.3
Path traversal in Onionshare
Affected: from 2.3, fixed in 2.5; fixed in 2.5.
- CVE-2022-21691Medium 4.3
Improper Access Control in Onionshare
Affected: fixed in 2.5; from 2.3, fixed in 2.5.
- CVE-2022-21695Medium 4.3
Improper Access Control in Onionshare
Affected: from 2.3, fixed in 2.5; fixed in 2.5.
- CVE-2022-21688High 7.5
Out-of-bounds Read in Onionshare
Affected: fixed in 2.5.
- CVE-2022-21696Medium 4.3
Username spoofing in OnionShare
Affected: fixed in 2.5; from 2.3, fixed in 2.5.
- CVE-2021-41867Unrated
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of…
Affected: from 2.3, fixed in 2.4.
- CVE-2021-41868Unrated
OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive…
Affected: from 2.3, fixed in 2.4.