THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-v833-3823-cmhp (medium) — OnionShare Receive mode writes uploaded files even when file uploads are disabled

[GHSA] GHSA-v833-3823-cmhp (medium) — OnionShare Receive mode writes uploaded files even when file uploads are disabled

highgithub_advisoriesPublished 2026-07-31

GHSA-v833-3823-cmhp Severity: medium CVE: CVE-2026-54707

OnionShare Receive mode writes uploaded files even when file uploads are disabled

### Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode `disable_files` setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint (`--disable-files` / "Disable uploading files"), a remote sender w

Indicators of compromise

8cc75e1d7e88bd31f7276733449d412bf71c8999sha1
CVE-2026-54707cve

Original source: https://github.com/advisories/GHSA-v833-3823-cmhp