CVE-2026-54707

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disable_files setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint (--disable-files / "Disable uploading files"), a remote sender who can reach the OnionShare service can still send a crafted multipart request containing file[]; OnionShare writes the uploaded bytes to disk before the route handler skips file accounting. This affects the shipped onionshare-cli Python package and the desktop application because both use the same onionshare_cli.web.receive_mode request-streaming implementation. Details Tested repository: https://github.com/onionshare/onionshare at commit 8cc75e1d7e88bd31f7276733449d412bf71c8999. Affected product evidence: - cli/pyproject.toml declares onionshare_cli version 2.6.3. - desktop/pyproject.toml declares onionshare version 2.6.3 and depends on onionshare_cli from ../cli. - cli/setup.py publishes onionshare-cli and includes onionshare_cli.web plus templates/static resources. - desktop/setup.py publishes onionshare and exposes both onionshare and onionshare-cli console scripts. Reachable default/common paths: - CLI Receive mode is exposed through --receive (cli/onionshare_cli/init.py:55-57). - The --disable-files option is documented and stored in mode settings (cli/onionshare_cli/init.py:156-160, cli/onionshare_cli/init.py:254-261). - Desktop Receive mode exposes the same setting via the "Disable uploading files" checkbox and stores it as receive.disable_files (desktop/onionshare/tab/mode/receive_mode/init.py:89-99, desktop/onionshare/tab/mode/receive_mode/init.py:246-254). - User documentation says "Disable uploading files" should "only allow submitting text messages, like for an anonymous contact form" (docs/source/features.rst:64). - Advanced documentation lists --disable-files and disable_files as the option to disable receiving files (docs/source/advanced.rst:162-163, docs/source/advanced.rst:455). Root cause: - The

[![CVE-2026-54707 status](https://www.csirts.com/badge/CVE-2026-54707)](https://www.csirts.com/cve/CVE-2026-54707)