| Package | Affected versions | Patched versions |
|---|---|---|
| onionshare-cli | ≤ 1.3.1 | |
| onionshare | ≤ 1.3.1 |
This advisory has been withdrawn because the advisory concerns the repository https://github.com/onionshare/onionshare, which is not in a supported ecosystem. onionshare-cli is not affected by this issue.
The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free