hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.
{ "binaries": [ { "binary_name": "onionshare", "binary_version": "0.8.1-1ubuntu0.1~esm1" } ] }
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-5026.json"