What is the CVSS score of CVE-2026-54707?

CVE-2026-54707 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-54707?

Yes, a public proof-of-concept exploit is available for CVE-2026-54707. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-54707?

Yes, a patch is available for CVE-2026-54707. Update the affected software to the latest version immediately.

OnionShare CVE-2026-54707

EUVD-2026-51570 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-14 vendor:ubuntu

GHSA-v833-3823-cmhp

Authentication Bypass

5.4

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible Tor service, no authentication required, attacker writes files (integrity) and may exhaust disk (availability), no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Jul 31, 2026 - 17:22 NVD

5.4 (MEDIUM)

Analysis Generated

Jul 16, 2026 - 09:31 vuln.today

DescriptionCVE.org

[OnionShare Receive mode writes uploaded files even when file uploads are disabled]

AnalysisAI

OnionShare's Receive mode incorrectly writes uploaded files to disk even when the operator has explicitly disabled file uploads, allowing unauthenticated remote attackers over Tor to bypass the access-control setting and deposit files on the host system. This affects deployments where operators have configured the 'disable uploads' option with an expectation that no inbound file writes will occur. No public exploit code or CISA KEV listing is identified at time of analysis, but the logic bypass is straightforward and exploitable against any exposed OnionShare Receive-mode instance with uploads disabled.

Technical ContextAI

OnionShare is an open-source tool that creates ephemeral .onion services over the Tor network to enable anonymous file sharing, website hosting, and chat. Its Receive mode acts as an anonymous upload endpoint, intended to allow whistleblowers or third parties to drop files to the operator. The 'disable uploads' toggle is a configuration control designed to halt inbound file writes. The vulnerability indicates a failure in the conditional logic path that enforces this setting - the file-write operation executes regardless of the configuration flag. This maps to an authorization enforcement failure (consistent with CWE-284 Improper Access Control or CWE-863 Incorrect Authorization), where a security-relevant configuration value is checked insufficiently or bypassed at the file-write layer. No CPE string or CWE ID was provided in the source data.

RemediationAI

No vendor-released patch version is confirmed in the available data. Operators should monitor the OnionShare upstream repository (https://github.com/onionshare/onionshare) and Ubuntu Security Notices for a patched release. As an immediate compensating control, operators who require the upload-disable feature as a security boundary should shut down their OnionShare Receive-mode service until a fix is confirmed, since the configuration toggle cannot be trusted to prevent file writes. Alternatively, operators can monitor the OnionShare data directory for unexpected file creation using filesystem audit tooling (e.g., inotifywait on Linux) and alert on writes. Restricting network access to the .onion address at the Tor hidden service level is not a reliable workaround since the Tor network is the intended transport. The trade-off of taking the service offline is loss of legitimate receive functionality; the trade-off of filesystem monitoring is operational overhead without preventing the write.