{"id":"CVE-2026-42448","aliases":["GHSA-cf92-gfcw-6v53","PYSEC-2026-2616"],"title":"Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed","summary":"Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","vendor":"magic-wormhole","product":"magic-wormhole","ecosystem":"pip","affected":["magic-wormhole >= 0.23.0, < 0.24.0"],"patched":["magic-wormhole 0.24.0"],"published":"2026-05-06","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cf92-gfcw-6v53","references":[{"url":"https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42448"},{"url":"https://github.com/magic-wormhole/magic-wormhole"}],"tags":["osv","pip"],"epss":0.00197,"epssPercentile":0.0966,"ingestedAt":"2026-07-13T18:57:56.401Z","slug":"CVE-2026-42448","body":"## Overview\n\n### Impact\nA receiver who specifies \"--output <dir>\" where that output directory currently exists (as a directory).\n\n### Patches\n0.24.0 will contain the patch\n\n### Workarounds\nEnsure local target directories specified by \"--output\" do not already exist\n\n### Resources\nPrivate email and Signal communications from a user.\nMagic Wormhole thanks  @marduc812\n\n## Affected packages\n\n- `magic-wormhole >= 0.23.0, < 0.24.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `magic-wormhole 0.24.0`","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}