CVE-2021-41868

Remote unauthenticated attackers able to upload files in Onionshare

9.8 CriticalFix available

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.42%Up 1.6 points since Oct 5, 2021

What each source reports

NVD Score used 9.8

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: CVE-2021-41868
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: CVE-2021-41868
Updated: 2026-11-02

EUVDEUVD-2021-2314 No score

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: EUVD-2021-2314
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7g47-xxff-9p85 9.8

Remote unauthenticated attackers able to upload files in Onionshare

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: GHSA-7g47-xxff-9p85
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 9.8

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: CVE-2021-41868
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-41868 9.8

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: DEBIAN-CVE-2021-41868
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVGHSA-7g47-xxff-9p85 9.8

Remote unauthenticated attackers able to upload files in Onionshare

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: GHSA-7g47-xxff-9p85
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2026-434 9.8

Remote unauthenticated attackers able to upload files in Onionshare

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: PYSEC-2026-434
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-41868 9.8

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.

Record: UBUNTU-CVE-2021-41868
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11557-1 No score

python-onionshare-2.4-1.1 on GA media

These are all security issues fixed in the python-onionshare-2.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11557-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13635-1 No score

python3-onionshare-2.6-4.1 on GA media

These are all security issues fixed in the python3-onionshare-2.6-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13635-1
Updated: 2026-11-02

Affected products

onionshare

Affected packages

Affected packages
Package	Affected	Fixed
`onionshare-cli` PyPI	2.3 up to 2.4	2.4
`onionshare` Debian:12	before 2.5-1	2.5-1
`onionshare` Debian:13	before 2.5-1	2.5-1
`onionshare` Debian:14	before 2.5-1	2.5-1
`onionshare-cli` PyPI	2.3 up to 2.4, plus listed versions 2.3.12.3.22.3.3	2.4
`onionshare` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 0.7-10.7.1-10.8.1-10.8.1-1ubuntu0.1~esm1	None known
`onionshare` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 0.9.2-10.9.2-1ubuntu0.1~esm1	None known
`onionshare` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 2.1-12.2-12.2-1ubuntu0.1~esm1	None known
`onionshare` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 2.2-32.2-3ubuntu0.1~esm1	None known
`python-onionshare` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 2.4-1.1	2.4-1.1
`python3-onionshare` openSUSE:Tumbleweed From an advisory covering 11 CVEs	before 2.6-4.1	2.6-4.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41868 is a critical vulnerability (CVSS 9.8) in Onionshare, published October 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in onionshare-cli 2.4.

References

Show 16 moreShow less