GitHub Advisoryadvisory · PyPI

GHSA-cf92-gfcw-6v53 Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed

LOW Published 2026-05-06 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-42448
Ecosystem
PyPI
Packages
magic-wormhole
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-22
Reviewed
2026-05-06

Affected packages

• PyPI magic-wormhole: >= 0.23.0, < 0.24.0 → fixed in 0.24.0

Description

Impact A receiver who specifies "--output " where that output directory currently exists (as a directory). Patches 0.24.0 will contain the patch Workarounds Ensure local target directories specified by "--output" do not already exist Resources Private email and Signal communications from a user. Magic Wormhole thanks @marduc812

Related

Alias · CVE (1)

  • CVE-2026-42448 Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References