CVE-2021-41868
CRITICALOnionShare 2.3-2.4 - Unauthenticated Arbitrary File Upload via Receive Mode
Title source: llmDescription
OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.
References (2)
Core 2
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/onionshare/onionshare/compare/v2.3.3...v2.4
Exploit, Third Party Advisory x_refsource_misc
https://www.ihteam.net/advisory/onionshare/
Scores
CVSS v3
9.8
EPSS
0.0232
EPSS Percentile
81.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (2)
onionshare/onionshare
2.3 - 2.4
pypi/onionshare-cli
2.3 - 2.4PyPI
Published
Oct 04, 2021
Tracked Since
Feb 18, 2026