Skip to content

OnionShare Changelog

Release summaries for OnionShare, condensed from upstream changelogs and security advisories. Newest at the top.

OnionShare ships far less often than Tor Browser or Tails: fifteen months passed between 2.6.3 and 2.6.4. A long gap between releases is normal here, so the thing to watch is whether a given release fixes something that affects how you use it.

OnionShare 2.6.5

2026-07-28 · Upstream release

  • Dependency updates covering the bundled tor, Python packages, and web-side dependencies.
  • No new features or behaviour changes. The two security fixes from 2.6.4 remain the reason to upgrade, and anyone still on 2.6.3 can go straight to 2.6.5.

OnionShare 2.6.4

2026-06-09 · Upstream release

  • Fixes two security issues affecting 2.6.3 and earlier. Both the desktop app and onionshare-cli are affected, since they share the same web module.
  • CVE-2026-54706 (GHSA-22p9-r2f5-22mf): Share mode and Website mode followed symlinks inside the selected directory and served the link target instead of restricting access to files physically inside that directory. If the shared directory contains attacker-supplied or otherwise untrusted symlinks, whoever has the onion address can read other local files readable by the OnionShare process. Rated medium severity — exploiting it requires getting a symlink into the directory you share.
  • CVE-2026-54707 (GHSA-v833-3823-cmhp): With "Disable uploading files" enabled in Receive mode, the restriction was not enforced at the write sink. A crafted multipart request still wrote the uploaded bytes to disk; the route handler merely skipped the upload accounting. A service configured as a text-message-only endpoint could therefore be made to write unexpected files. The same release also stops an empty POST payload from creating an empty folder.
  • Dependency updates, including the bundled tor and the flatpak runtime.
  • Tor connection now shows indeterminate progress and warns the user while it waits, instead of looking unresponsive.

OnionShare 2.6.3

2025-02-25 · Upstream release

  • The CLI gained --log-filenames, showing which URLs are visited in Share and Website mode.
  • A saved persistent onion tab can now start automatically once OnionShare launches and Tor connects.
  • Fixed bridge requests and meek as a pluggable transport, plus a fatal error when censorship circumvention returned no bridges.
  • Fixed a thread race segfault on CLI shutdown, and the auto-stop timer failing in Share mode after someone had visited the share.
  • Added Irish, Slovak, and Tamil interface translations, with improvements across existing languages.
  • Documentation now covers every config file parameter, and includes a systemd unit example for persistent onions.
  • Packaging: the snap builds for Ubuntu 24.04 and later, ARM64 flatpak packaging was fixed, and armhf support was dropped for now because PySide6 packages are unavailable for that architecture.

OnionShare 2.6.2

2024-03-21 · Upstream release

  • An all-security release, concentrated on input handling in Receive mode and Chat mode.
  • Newlines are stripped from History item paths.
  • Text messages in Receive mode are capped at 524288 characters.
  • Usernames are restricted to specific ASCII characters with control characters removed, and username validation exceptions are handled so users can no longer join silently.
  • Users are forcefully disconnected from chat on a disconnect event.