{"id":"CVE-2026-32116","aliases":["GHSA-4g4c-mfqg-pj8r","PYSEC-2026-2615"],"title":"Magic Wormhole: \"wormhole receive\" allows arbitrary local file overwrite","summary":"Magic Wormhole: \"wormhole receive\" allows arbitrary local file overwrite","severity":"high","vendor":"magic-wormhole","product":"magic-wormhole","ecosystem":"pip","affected":["magic-wormhole >= 0.21.0, < 0.23.0"],"patched":["magic-wormhole 0.23.0"],"published":"2026-03-13","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4g4c-mfqg-pj8r","references":[{"url":"https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-4g4c-mfqg-pj8r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32116"},{"url":"https://github.com/magic-wormhole/magic-wormhole"}],"tags":["osv","pip"],"epss":0.0035,"epssPercentile":0.28696,"ingestedAt":"2026-07-13T18:57:52.571Z","slug":"CVE-2026-32116","body":"## Overview\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nReceiving a file (`wormhole receive`) from a malicious party could result in overwriting critical local files, including `~/.ssh/authorized_keys` and `.bashrc`. This could be used to compromise the receiver's computer.\n\nOnly the sender of the file (the party who runs `wormhole send`) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThe bug has been fixed in magic-wormhole 0.23.0. All users should upgrade to this version.\n\nThe vulnerability first surfaced in the 0.21.0 release on 23-Oct-2025.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nAs a workaround, the receiver can override the sender's filename with the `--output` or `-o` option. For example: `wormhole receive -o shopping-list.txt` will write the file to `shopping-list.txt` in the local directory, regardless of what the sender tries to do. To be effective, this option must be added to every invocation of `wormhole receive` / `wormhole rx`.\n\n### References\n_Are there any links users can visit to find out more?_\n\nIncoming file transfer requests include a `filename`, used to decide where the file contents will be written. Well-behaving senders compute this from the `basename()` of the sent file (which discards all but the last segment of the path). To guard against malicious senders, the receiver also applies `basename()` to the incoming filename. During refactoring in version 0.21.0, this receiver-side check was accidentally dropped. The check was restored in version 0.23.0 along with a unit test.\n\nMany thanks to Ian McKenzie (@ikmckenz) for spotting the bug and reaching out with a fix.\n\n## Affected packages\n\n- `magic-wormhole >= 0.21.0, < 0.23.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `magic-wormhole 0.23.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}