CVE-2026-42448 wormhole receive, with --output pointing at an existing directory can be path-traversed
An attacker can write files outside the intended directory when a receiver uses an existing output directory, potentially overwriting local files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42448?
CVE-2026-42448 is a low-severity path traversal vulnerability in magic-wormhole, published on 26 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-42448?
3 open source packages ship an affected version, including magic-wormhole.
| Package | Affected | Fixed in |
|---|---|---|
magic-wormhole PyPI | From 0.23.0 | 0.24.0 |
magic-wormhole PyPI | From 0.23.0 | 0.24.0 |
magic-wormhole PyPI | From 0.23.0 | 0.24.0 |
Linux distribution packages (1)
python-magic-wormhole openSUSE:Tumbleweed | All versions | 0.24.0-1.1 |
How do I fix CVE-2026-42448?
Upgrade magic-wormhole to 0.24.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-42448 being exploited?
There is no known exploitation of CVE-2026-42448 in the wild and no public exploit code.
Sources
Also known as GHSA-cf92-gfcw-6v53, PYSEC-2026-2616, openSUSE-SU-2026:11370-1.