CVE-2026-42448
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A path traversal vulnerability was found in Magic Wormhole before version 0.24.0 when receiving files with the '--output <dir>' option and the target directory already exists. This allows writing files outside the intended directory.
Risk Assessment
An attacker can overwrite arbitrary files on the victim's system, potentially leading to data corruption, malicious code injection, or privilege escalation.
Recommendation
Update Magic Wormhole to version 0.24.0 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0.