What is the CVSS score of EUVD-2026-51571?

EUVD-2026-51571 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-51571?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51571. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-51571?

Yes, a patch is available for EUVD-2026-51571. Update the affected software to the latest version immediately.

OnionShare EUVD-2026-51571

| CVE-2026-54706 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-07-14 vendor:ubuntu

GHSA-22p9-r2f5-22mf

Information Disclosure

4.8

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-served share exploited remotely (AV:N, AC:L, PR:N); victim must share a directory with symlinks present (UI:R); confidentiality high, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 31, 2026 - 17:22 NVD

4.8 (MEDIUM)

Analysis Generated

Jul 16, 2026 - 09:31 vuln.today

DescriptionCVE.org

[OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files]

AnalysisAI

OnionShare fails to restrict symlink traversal within shared directories, allowing any recipient of a file share to read arbitrary local files on the sharer's machine. When a user shares a directory containing symbolic links, OnionShare follows those links and serves the linked files over the Tor .onion URL - including files and directories outside the intended share root. This is an information-disclosure vulnerability affecting users of OnionShare who share directories that contain symlinks, whether knowingly or not. No public exploit code or active exploitation has been identified at time of analysis, and the issue was reported through Ubuntu's vendor security channel.

Technical ContextAI

OnionShare is an open-source privacy tool that exposes local directories as file servers over the Tor anonymity network, generating .onion addresses for recipients. The vulnerability is a symlink-following (TOCTOU-adjacent) path escape: when serving files from a user-selected directory, OnionShare does not validate that a resolved symlink target remains within the share root. This is consistent with CWE-59 (Improper Link Resolution Before File Access), a well-understood class of directory traversal via symbolic links. No CPE string was provided in the available data, so exact affected versions cannot be confirmed from this source. The Ubuntu vendor report suggests affected packages exist in at least one Ubuntu release series. Common filesystem tooling (ln -s) is all that is required to create the triggering condition, making the class of exploit trivially reproducible once the issue is understood.

RemediationAI

No vendor-released patch version has been identified at time of analysis. The primary remediation is to upgrade OnionShare to a fixed release once one is published; monitor the OnionShare GitHub repository and Ubuntu security advisories (ubuntu.com/security/cve) for patch availability. As an immediate compensating control, users should audit shared directories for symlinks before initiating a share - running 'find /path/to/share -type l' will enumerate all symbolic links present. Removing or resolving symlinks before sharing eliminates the attack surface entirely with no functional side effects for recipients. As an additional defensive measure, only share leaf directories containing only regular files when the recipient is not fully trusted. Do not share home directories, project roots, or any directory tree that may contain symlinks created by development tools, package managers, or OS configuration.