{"cve":"CVE-2022-21693","nvd":{"published":"2022-01-18T22:15:08.093","modified":"2026-06-17T04:26:46.583","status":"Analyzed","description":"OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions an adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced. This can be mitigated by usage of the flatpak release.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-22"],"references":["https://github.com/onionshare/onionshare/releases/tag/v2.5","https://github.com/onionshare/onionshare/security/advisories/GHSA-jgm9-xpfj-4fq6","https://github.com/onionshare/onionshare/releases/tag/v2.5","https://github.com/onionshare/onionshare/security/advisories/GHSA-jgm9-xpfj-4fq6"],"products":["onionshare:onionshare"],"source":"nvd","synced_at":"2026-10-19T21:27:20.926095847+00:00"},"epss":{"cve":"CVE-2022-21693","score":0.01161,"percentile":0.67161,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-jgm9-xpfj-4fq6","url":"https://osv.dev/vulnerability/GHSA-jgm9-xpfj-4fq6","summary":"Path traversal in Onionshare","modified":"2024-10-07T21:08:21.121420Z","packages":[{"ecosystem":"PyPI","name":"onionshare-cli","purl":"pkg:pypi/onionshare-cli","ranges":[">=2.3 <2.5"],"fixed":["2.5"]}]},{"id":"PYSEC-2022-44","url":"https://osv.dev/vulnerability/PYSEC-2022-44","summary":"","modified":"2023-11-08T04:08:08.248497Z","packages":[{"ecosystem":"PyPI","name":"onionshare-cli","purl":"pkg:pypi/onionshare-cli","ranges":["<2.5"],"fixed":["2.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}