GitHub Advisoryadvisory · PyPI

GHSA-7g47-xxff-9p85 Remote unauthenticated attackers able to upload files in Onionshare

CRITICAL Published 2021-11-19 Modified 2021-10-13 Official page ↗

Aliases: CVE-2021-41868
Ecosystem: PyPI
Packages: onionshare-cli
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reviewed: 2021-10-05

Affected packages

• PyPI onionshare-cli: >= 2.3, < 2.4 → fixed in 2.4

Description

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Related

Alias · CVE (1)

CVE-2021-41868 OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive… vulnerability

References