CVE-2022-21693 — onionshare-cli
MEDIUMCVE-2022-21693 is a medium-severity (CVSS 6.3) Path Traversal vulnerability in onionshare-cli. A fix is available for onionshare-cli — see the affected versions and patch details below.
Path traversal in Onionshare
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2022-21693.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2022-21693 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
onionshare-cliReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test.
- Vulnerability ID: OTF-013
- Vulnerability type: Improper Hardening
- Threat level: Low
Description:
The filesystem restriction could be hardened and should only allow for pre-defined subfolders.
Technical description:
The Flatpak and Snap configurations allow for read-only access on the whole home folder. The relevant lines in the configuration files are onionshare/snap/snapcraft.yaml#L20 and onionshare/flatpak/org.onionshare.OnionShare.yaml#L19 , respectively.
The encapsulation of filesystem access via these mechanisms should be restricted to pre-defined folders and not allow for access to (configuration) files outside the Onionshare-specific folders.
Sadly Snap does not allow for further restriction to specific folders and therefore cannot be further hardened. By default both frameworks disallow access to hidden folders and therefore reduce the potential impact.
Impact:
An adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced.
Recommendation:
- Reduce read access in Flatpak configuration.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | onionshare-cli | ≥ 2.3&&< 2.5 | 2.5pip install --upgrade 'onionshare-cli==2.5' |
Affected Products
onionshareonionshareDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for onionshare-cli, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update onionshare-cli to 2.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-21693 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is CVE-2022-21693 in your dependencies?
Find it across PyPI, including transitive dependencies.