CVE-2026-42448: Magic Wormhole Path Traversal Flaw

CVE-2026-42448 Overview

CVE-2026-42448 is a path traversal vulnerability [CWE-22] in Magic Wormhole, a tool that transfers arbitrary-sized files and directories between computers. The flaw affects versions prior to 0.24.0. When a receiver invokes the client with --output <dir> and the specified directory already exists, an attacker controlling the sender side can write files outside the intended output directory. The maintainers fixed the issue in version 0.24.0.

Critical Impact
A malicious sender can write files outside the receiver-specified output directory when that directory already exists, leading to limited integrity impact on the receiving system.

Affected Products

Magic Wormhole versions prior to 0.24.0
Receivers using the --output <dir> command-line option
Systems where the specified output directory already exists as a directory

Discovery Timeline

2026-05-26 - CVE-2026-42448 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-42448

Vulnerability Analysis

Magic Wormhole transfers files and directories over the network using short human-pronounceable codes. The receiver client accepts a --output <dir> argument that selects a destination directory for incoming transfers. Prior to version 0.24.0, the receiver did not properly constrain file paths inside the transferred payload when the output directory already existed.

A sender that crafts filenames containing path traversal sequences such as ../ can place files outside the receiver's intended output directory. The vulnerability requires user interaction because the receiver must explicitly accept the transfer. Exploitation is limited by the privileges of the receiving user and yields integrity impact without confidentiality or availability loss.

Root Cause

The root cause is missing or insufficient sanitization of path components within the transferred archive when the target output directory pre-exists. The receiver resolves filenames relative to the supplied directory without canonicalizing the result and verifying it remains inside the intended root.

Attack Vector

The attack vector is network-based and requires the receiver to accept a wormhole code from the sender. The attacker crafts a transfer where file entries contain traversal sequences. When the receiver runs wormhole receive --output existing_dir/, the receiver writes files to attacker-chosen locations outside existing_dir/. See the GitHub Security Advisory GHSA-cf92-gfcw-6v53 for upstream technical detail.

Detection Methods for CVE-2026-42448

Indicators of Compromise

Files written outside the directory specified by --output after a wormhole receive operation
Magic Wormhole client versions earlier than 0.24.0 present on receiving hosts
Unexpected file modifications in parent directories or sibling paths of designated wormhole output folders

Detection Strategies

Inventory installed Magic Wormhole package versions across endpoints and flag any version below 0.24.0
Audit shell history and process telemetry for invocations of wormhole receive --output targeting existing directories
Monitor filesystem events for write operations originating from the Magic Wormhole process that resolve outside the supplied output path

Monitoring Recommendations

Log all Magic Wormhole client executions and their command-line arguments through endpoint telemetry
Alert on writes by the wormhole client process to paths containing .. sequences during transfer operations
Track network connections to Magic Wormhole rendezvous servers to identify systems using the tool

How to Mitigate CVE-2026-42448

Immediate Actions Required

Upgrade Magic Wormhole to version 0.24.0 or later on all endpoints where the client is installed
Audit existing installations using pip show magic-wormhole or the equivalent package manager command to identify vulnerable versions
Restrict use of the --output flag to directories that do not already exist until the upgrade is complete

Patch Information

The vulnerability is fixed in Magic Wormhole 0.24.0. Upgrade using pip install --upgrade magic-wormhole. The patch details and remediation guidance are documented in the GitHub Security Advisory GHSA-cf92-gfcw-6v53.

Workarounds

Avoid passing --output with a pre-existing directory; let the receiver create a new target directory for each transfer
Only accept wormhole codes from trusted senders, since exploitation requires user interaction to accept the transfer
Run the receiver under a non-privileged account in a sandboxed working directory to limit the scope of any traversal

bash

# Upgrade Magic Wormhole to the fixed release
pip install --upgrade 'magic-wormhole>=0.24.0'

# Verify the installed version
wormhole --version