PyPI/onionshare-cli CVE-2026-54706: medium 4.8, EPSS 0.34%

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

Action: Upgrade onionshare-cli to 2.6.4 or later.

pip install onionshare-cli==2.6.4

Affected

Fixed versions

Sources

• osv: GHSA-22p9-r2f5-22mf
• https://github.com/onionshare/onionshare/security/advisories/GHSA-22p9-r2f5-22mf
• https://github.com/onionshare/onionshare/commit/48f31cfac077fcc9c04c67c2a6dbf87d956f5eec
• https://github.com/onionshare/onionshare
• https://github.com/onionshare/onionshare/releases/tag/v2.6.4

CVE-2026-54706 · published 2026-07-31T16:31:37Z · modified 2026-08-04T14:41:07.225190082Z · JSON