CVE-2026-54707

OnionShare 2.0.0 through 2.6.3 contains a vulnerability where the `disable_files` setting — intended to enforce text-only mode in receive mode — is not checked in the `_get_file_stream()` code path. Files are written to disk regardless of this configuration. The permission check exists in the codebase; it was simply never wired into this particular upload flow, representing a classic enforcement gap in privacy-critical software. If you use OnionShare in receive mode: treat any version before 2.6.4 as having no effective text-only enforcement. Assume that any instance configured with `disable_files` may have silently accepted files. This matters especially if you chose text-only mode for operational security reasons — journalist-source communication, activist document handling, or any scenario where file reception creates vector exposure. The exposure is not merely technical; it potentially invalidates the threat model you built around the tool. The fix in 2.6.4 is reportedly a single conditional check. This simplicity is the most concerning aspect: it indicates the enforcement gap was not a complex architectural failure but a missing checkpoint in a single code path. Audit your deployments. Check any OnionShare instances you operate that claim text-only mode — there is no reliable log indicating whether files were received during the vulnerable window. Consider whether any contacts who shared files during versions 2.0.0–2.6.3 may have done so believing the recipient had blocked file reception. For security teams evaluating privacy tools: this CVE demonstrates that settings enforcement must be verified at every code path that handles sensitive data, not just at the configuration layer. The existence of a permission check in documentation or even in other code paths provides false assurance if it is not architecturally unified. Prioritize tools where security-critical settings are enforced as unified permission gates rather than scattered conditionals — the latter pattern has produced repeated vulnerabilities in PGP, Tor Browser, and now OnionShare. The CVSS 5.4 score fundamentally misrepresents risk for tools where the entire value proposition depends on settings being enforced; the real impact is epistemic harm when users discover their threat model was based on a configuration that was never implemented.

Reviewed through automated stages and approved by a human before publication.