CVE-2026-42448 PUBLISHED

wormhole receive, with --output pointing at an existing directory can be path-traversed

Assigner: GitHub_M
Reserved: 27.04.2026 Published: 26.05.2026 Updated: 27.05.2026

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS Score: 3.5

Product Status

Vendor magic-wormhole
Product magic-wormhole
Versions
  • Version < 0.24.0 is affected

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE