EUVD-2026-51570
GHSA-v833-3823-cmhp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-accessible Tor service, no authentication required, attacker writes files (integrity) and may exhaust disk (availability), no confidentiality impact.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[OnionShare Receive mode writes uploaded files even when file uploads are disabled]
AnalysisAI
OnionShare's Receive mode incorrectly writes uploaded files to disk even when the operator has explicitly disabled file uploads, allowing unauthenticated remote attackers over Tor to bypass the access-control setting and deposit files on the host system. This affects deployments where operators have configured the 'disable uploads' option with an expectation that no inbound file writes will occur. No public exploit code or CISA KEV listing is identified at time of analysis, but the logic bypass is straightforward and exploitable against any exposed OnionShare Receive-mode instance with uploads disabled.
Technical ContextAI
OnionShare is an open-source tool that creates ephemeral .onion services over the Tor network to enable anonymous file sharing, website hosting, and chat. Its Receive mode acts as an anonymous upload endpoint, intended to allow whistleblowers or third parties to drop files to the operator. The 'disable uploads' toggle is a configuration control designed to halt inbound file writes. The vulnerability indicates a failure in the conditional logic path that enforces this setting - the file-write operation executes regardless of the configuration flag. This maps to an authorization enforcement failure (consistent with CWE-284 Improper Access Control or CWE-863 Incorrect Authorization), where a security-relevant configuration value is checked insufficiently or bypassed at the file-write layer. No CPE string or CWE ID was provided in the source data.
RemediationAI
No vendor-released patch version is confirmed in the available data. Operators should monitor the OnionShare upstream repository (https://github.com/onionshare/onionshare) and Ubuntu Security Notices for a patched release. As an immediate compensating control, operators who require the upload-disable feature as a security boundary should shut down their OnionShare Receive-mode service until a fix is confirmed, since the configuration toggle cannot be trusted to prevent file writes. Alternatively, operators can monitor the OnionShare data directory for unexpected file creation using filesystem audit tooling (e.g., inotifywait on Linux) and alert on writes. Restricting network access to the .onion address at the Tor hidden service level is not a reliable workaround since the Tor network is the intended transport. The trade-off of taking the service offline is loss of legitimate receive functionality; the trade-off of filesystem monitoring is operational overhead without preventing the write.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today