When OnionShare Run in Receive mode, the software should honour the disable_files setting and reject all file uploads. Instead, prior to version 2.6.4 the code that handles multipart uploads writes the entire file payload to disk regardless of that setting. This bug means a malicious sender can cause local files to be written or existing files to be overwritten, compromising the confidentiality and integrity of the host machine's filesystem. The weakness is an authorization bypass where a user-controlled key (the configuration flag) is ignored, leading to unintended data persistence on the server side.

All installations of OnionShare older than version 2.6.4, regardless of operating system. The bug manifests in both the command‑line interface and the desktop application when the receive mode is enabled and the configuration option disable_files is set to true.

The CVSS score of 5.4 indicates a medium severity impact. The EPSS score of less than 1% suggests a very low probability of exploitation observed in the wild. The advisory is not catalogued as a known exploited vulnerability by CISA. Exploitation requires the attacker to successfully submit a file via the receive mode; no remote code execution is involved but the attacker gains the ability to write arbitrary files to the local filesystem.