PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5026 Onionshare CVE debrief

CVE-2016-5026 is a local privilege and access-control issue in OnionShare before 0.9.1. If a local user pre-created the /tmp/onionshare directory, hs.py could be influenced so the hidden service was modified. The practical impact is integrity loss rather than remote compromise, and it is most relevant on multi-user systems where untrusted local users can write to shared temporary locations.

Vendor
Onionshare
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Administrators and users running OnionShare on shared Linux or Unix-like systems, especially where multiple local accounts can interact with /tmp. Security teams should care if OnionShare is used in environments with untrusted local users.

Technical summary

NVD classifies the issue as CWE-284 (Improper Access Control) with CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The vulnerability affects OnionShare versions up to and including 0.9.0. By pre-creating /tmp/onionshare, a local user could interfere with hs.py's handling of the hidden service and alter it before the application secured the directory or otherwise validated its state.

Defensive priority

Medium. The issue requires local access, but it can enable meaningful integrity impact on shared systems and should be remediated where OnionShare is deployed alongside untrusted local users.

Recommended defensive actions

  • Upgrade OnionShare to version 0.9.1 or later.
  • Review deployments on multi-user systems for shared /tmp usage and local account separation.
  • Restrict who can log into systems running OnionShare when practical.
  • Monitor for unexpected filesystem state under /tmp/onionshare during startup.
  • Validate that the installed OnionShare version is outside the affected range (0.9.0 and earlier).

Evidence notes

The CVE description states that hs.py in OnionShare before 0.9.1 allows local users to modify the hidden service by pre-creating /tmp/onionshare. NVD lists the affected CPE range as OnionShare through 0.9.0 and assigns CWE-284. This debrief stays within the supplied record and does not infer exploit details beyond the documented local directory pre-creation behavior.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5026 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5026

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5026 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5026

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.