CyberRota Analysis
AI-GeneratedOnionShare versions prior to 2.6.4 are vulnerable due to a failure to enforce the 'disable_files' setting in Receive mode, allowing multipart file data to be written to disk even when only text is intended. This could lead to unintended file exposure, compromising the anonymity and security of users. Organizations utilizing OnionShare for secure file sharing should prioritize upgrading to version 2.6.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.