OnionShare, a tool for anonymous file sharing over Tor, can send files that are reachable through symbolic links in the user‑specified directory. When a user selects a directory to share, the CLI/desktop client follows symlinks inside the directory, causing the remote recipient to receive files outside the intended share path. This flaw allows a malicious recipient to read arbitrary local files on the sender’s machine, compromising confidentiality and potentially exposing sensitive data. The weakness is classified as CWE‑59, directory traversal via symbolic links.

The affected product is OnionShare prior to v2.6.4. The vulnerability exists in the OnionShare CLI/Desktop implementation that uses the SendBaseModeWeb.set_file_info() and stream_individual_file() paths. The fix is included in release v2.6.4 and later.

The CVSS score of 4.8 indicates moderate impact. The EPSS score is below 1 %, suggesting that the likelihood of exploitation is very low at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a remote file request via the Share or Website mode, with no authentication or network restriction beyond Tor. An attacker only needs to act as a normal recipient to trigger the symbolic‑link resolution and read local files.