CVE Tools
Track your stack

Onionshare

9 CVEs tracked since 2022. Since Jan 2022, none of them reached CISA KEV.

Onionshare CVEs per month

Jan 2022 to Jan 2022. Point at a month, or focus the strip and use the arrow keys.
Onionshare CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2022-0190

Products

The products that kept showing up in Onionshare's monthly top three, with their CVEs summed over those months.

  1. Onionshare91 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Onionshare.

  1. CVE-2026-54706OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files4.8
  2. CVE-2026-54707OnionShare Receive mode writes uploaded files even when file uploads are disabled5.4
  3. CVE-2022-21694OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website3.7
  4. CVE-2022-21690Cross-Site Scripting in Onionshare8.7
  5. CVE-2022-21692Improper Access Control in Onionshare4.3
  6. CVE-2022-21689Denial of Service in Onionshare7.5
  7. CVE-2022-21693Path traversal in Onionshare6.3
  8. CVE-2022-21691Improper Access Control in Onionshare4.3
  9. CVE-2022-21695Improper Access Control in Onionshare4.3
  10. CVE-2022-21688Out-of-bounds Read in Onionshare7.5
  11. CVE-2022-21696Username spoofing in OnionShare4.3
  12. CVE-2021-41867An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat...5.3
  13. CVE-2021-41868OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.9.8
  14. CVE-2018-19960The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite file...7.0
  15. CVE-2016-5026hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.5.5

The record

Peak rank
#66 in Jan 2022
Busiest month shown
Jan 2022, 9 CVEs
Months with a KEV entry
0 since Jan 2022
Monthly snapshots
1 since 2022
Onionshare's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store