CVE-2026-42448 — wormhole receive, with --output pointing at an existing directory can be path-traversed

CVE-2026-42448

wormhole receive, with --output pointing at an existing directory can be path-traversed PUBLISHED

Description (CNA)

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0.

Affected (CNA)

Vendor / product	Versions
magic-wormhole / magic-wormhole	affected < 0.24.0

CWE

CWE-22

References

https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.