---
id: CVE-2026-32116
aliases:
  - GHSA-4g4c-mfqg-pj8r
  - PYSEC-2026-2615
title: 'Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite'
summary: 'Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite'
severity: high
vendor: magic-wormhole
product: magic-wormhole
ecosystem: pip
affected:
  - 'magic-wormhole >= 0.21.0, < 0.23.0'
patched:
  - magic-wormhole 0.23.0
published: '2026-03-13'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4g4c-mfqg-pj8r'
references:
  - url: >-
      https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-4g4c-mfqg-pj8r
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32116'
  - url: 'https://github.com/magic-wormhole/magic-wormhole'
tags:
  - osv
  - pip
epss: 0.00507
epssPercentile: 0.40736
ingestedAt: '2026-07-13T18:57:52.571Z'
---

## Overview

### Impact
_What kind of vulnerability is it? Who is impacted?_

Receiving a file (`wormhole receive`) from a malicious party could result in overwriting critical local files, including `~/.ssh/authorized_keys` and `.bashrc`. This could be used to compromise the receiver's computer.

Only the sender of the file (the party who runs `wormhole send`) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

The bug has been fixed in magic-wormhole 0.23.0. All users should upgrade to this version.

The vulnerability first surfaced in the 0.21.0 release on 23-Oct-2025.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

As a workaround, the receiver can override the sender's filename with the `--output` or `-o` option. For example: `wormhole receive -o shopping-list.txt` will write the file to `shopping-list.txt` in the local directory, regardless of what the sender tries to do. To be effective, this option must be added to every invocation of `wormhole receive` / `wormhole rx`.

### References
_Are there any links users can visit to find out more?_

Incoming file transfer requests include a `filename`, used to decide where the file contents will be written. Well-behaving senders compute this from the `basename()` of the sent file (which discards all but the last segment of the path). To guard against malicious senders, the receiver also applies `basename()` to the incoming filename. During refactoring in version 0.21.0, this receiver-side check was accidentally dropped. The check was restored in version 0.23.0 along with a unit test.

Many thanks to Ian McKenzie (@ikmckenz) for spotting the bug and reaching out with a fix.

## Affected packages

- `magic-wormhole >= 0.21.0, < 0.23.0`

## Remediation

Upgrade to a patched release:

- `magic-wormhole 0.23.0`