CyberRota Analysis
AI-GeneratedOnionShare versions prior to 2.6.4 are vulnerable to a directory traversal issue that allows remote users to access local files outside the intended sharing directory through symbolic links. This could lead to unauthorized exposure of sensitive information for users sharing files or hosting websites. Users and administrators of OnionShare should prioritize upgrading to version 2.6.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.