https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T18:31:42.356090+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2019-04446 cnvd-2019-04446 2026-10-08T18:31:42.361530+00:00 cnvd-2019-04446 https://cve.radiocsirt.org/vuln/euvd-2026-168523 EUVD-2026-168523 2026-10-08T18:31:42.361562+00:00 EUVD-2026-168523 https://cve.radiocsirt.org/vuln/fkie_cve-2018-19960 fkie_cve-2018-19960 2026-10-08T18:31:42.361575+00:00

The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.

 https://cve.radiocsirt.org/vuln/ghsa-pwjq-6wrh-5w8q Withdrawn: GHSA-pwjq-6wrh-5w8q — Withdrawn Advisory: OnionShare Predictable Pathname 2026-10-08T18:31:42.361602+00:00

Withdrawn by the publisher.

Affected: PyPI: onionshare-cli

## Withdrawn Advisory This advisory has been withdrawn because the advisory concerns the repository https://github.com/onionshare/onionshare, which is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). [onionshare-cli](https://pypi.org/project/onionshare-cli/) is not affected by this issue.

## Original Description The `debug_mode` function in `web/web.py` in OnionShare through 1.3.1, when `--debug` is enabled, uses the `/tmp/onionshare_server.log` pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.

 https://cve.radiocsirt.org/vuln/gsd-2018-19960 gsd-2018-19960 2026-10-08T18:31:42.361628+00:00 gsd-2018-19960 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11246-1 openSUSE-SU-2024:11246-1 — python-onionshare-2.3.3-2.5 on GA media 2026-10-08T18:31:42.361640+00:00

python-onionshare-2.3.3-2.5 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-19960 UBUNTU-CVE-2018-19960 2026-10-08T18:31:42.361655+00:00

Affected: Ubuntu:Pro:16.04:LTS: onionshare, Ubuntu:Pro:18.04:LTS: onionshare

The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.