{"id":"CVE-2018-19960","aliases":["DEBIAN-CVE-2018-19960","EUVD-2022-4839","GHSA-pwjq-6wrh-5w8q","UBUNTU-CVE-2018-19960","USN-7625-1","openSUSE-SU-2024:11246-1","openSUSE-SU-2024:13635-1"],"status":"published","title":"Withdrawn Advisory: OnionShare Predictable Pathname","description":"The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00342,"percentile":0.27945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-12-07T16:00:00Z","modified":"2026-10-24T10:30:27Z","fixes":[{"ecosystem":"Debian:12","package":"onionshare","fixed_in":["1.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"onionshare","fixed_in":["1.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"onionshare","fixed_in":["1.3.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"onionshare","fixed_in":["0.8.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"onionshare","fixed_in":["0.9.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-onionshare","fixed_in":["2.3.3-2.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-1ubuntu0.1~esm1"}]}],"versions":["0.7-1","0.7.1-1","0.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1ubuntu0.1~esm1"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-1ubuntu0.1~esm1"}]}],"versions":["0.7-1","0.7.1-1","0.8.1-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1ubuntu0.1~esm1"}]}],"versions":["0.9.2-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.2-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-3ubuntu0.1~esm1"}]}],"versions":["2.2-3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-2.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python3-onionshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-4.1"}]}],"bundled":11}],"products":[{"vendor":"onionshare","product":"onionshare"}],"references":[{"url":"https://bugs.debian.org/915859","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19960","tags":["advisory"]},{"url":"https://github.com/onionshare/onionshare/issues/837","tags":["web"]},{"url":"https://github.com/onionshare/onionshare/commit/4da5e15581a69509e7bfc6c4d0742052e0b61b24","tags":["web"]},{"url":"https://github.com/onionshare/onionshare/commit/aa5fdde6a4e4de7f113e01a3b446dcc14dcecb1a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pwjq-6wrh-5w8q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19960","tags":["advisory"]},{"url":"https://github.com/onionshare/onionshare","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2018-19960","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19960","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7625-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21689","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21696","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-19960","description":"The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","status":"published","published":"2018-12-07T16:00:00Z","modified":"2024-09-16T18:44:08.903Z","updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2022-4839","description":"The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","status":"published","published":"2018-12-07T16:00:00Z","modified":"2024-09-16T18:44:08Z","updated_at":"2026-11-03T00:55:29.674428Z"}],"ghsa":[{"id":"GHSA-pwjq-6wrh-5w8q","title":"Withdrawn Advisory: OnionShare Predictable Pathname","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the advisory concerns the repository https://github.com/onionshare/onionshare, which is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). [onionshare-cli](https://pypi.org/project/onionshare-cli/) is not affected by this issue.\n\n## Original Description\nThe `debug_mode` function in `web/web.py` in OnionShare through 1.3.1, when `--debug` is enabled, uses the `/tmp/onionshare_server.log` pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","status":"withdrawn","published":"2022-05-14T01:36:38Z","modified":"2023-10-09T00:43:47Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:08.847568Z"}],"nvd":[{"id":"CVE-2018-19960","description":"The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","status":"published","published":"2018-12-07T16:29:00.63Z","modified":"2026-06-17T01:50:11.47Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:49.995593Z"}],"osv":[{"id":"CVE-2018-19960","description":"The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","status":"published","published":"2018-12-07T16:29:00.63Z","modified":"2026-10-24T10:30:27.435342583Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-19960","description":"The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","status":"published","published":"2018-12-07T16:29:00.63Z","modified":"2026-10-23T18:03:47.870077403Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"GHSA-pwjq-6wrh-5w8q","title":"Withdrawn Advisory: OnionShare Predictable Pathname","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the advisory concerns the repository https://github.com/onionshare/onionshare, which is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). [onionshare-cli](https://pypi.org/project/onionshare-cli/) is not affected by this issue.\n\n## Original Description\nThe `debug_mode` function in `web/web.py` in OnionShare through 1.3.1, when `--debug` is enabled, uses the `/tmp/onionshare_server.log` pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","status":"withdrawn","published":"2022-05-14T01:36:38Z","modified":"2026-09-10T03:49:24.149371652Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2018-19960","description":"The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","status":"published","published":"2018-12-07T16:29:00Z","modified":"2026-02-04T04:30:57.30634Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"openSUSE-SU-2024:11246-1","title":"python-onionshare-2.3.3-2.5 on GA media","description":"These are all security issues fixed in the python-onionshare-2.3.3-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:38:11.710984Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13635-1","title":"python3-onionshare-2.6-4.1 on GA media","description":"These are all security issues fixed in the python3-onionshare-2.6-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:53:21.676197Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"USN-7625-1","title":"onionshare vulnerabilities","description":"It was discovered that OnionShare could be exploited when run with\nthe --debug argument. A local attacker could possibly use this\nissue to access sensitive information. This issue only affected\nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19960)\n\nIt was discovered that OnionShare could be blocked from uploading\nfiles. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-21689)","status":"published","published":"2025-07-08T13:24:07Z","modified":"2026-06-25T13:32:30.57649949Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}