---
id: CVE-2026-42448
aliases:
  - GHSA-cf92-gfcw-6v53
  - PYSEC-2026-2616
title: >-
  Magic Wormhole: receive, with --output pointing at an existing directory can
  be path-traversed
summary: >-
  Magic Wormhole: receive, with --output pointing at an existing directory can
  be path-traversed
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N'
vendor: magic-wormhole
product: magic-wormhole
ecosystem: pip
affected:
  - 'magic-wormhole >= 0.23.0, < 0.24.0'
patched:
  - magic-wormhole 0.24.0
published: '2026-05-06'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cf92-gfcw-6v53'
references:
  - url: >-
      https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42448'
  - url: 'https://github.com/magic-wormhole/magic-wormhole'
tags:
  - osv
  - pip
epss: 0.00197
epssPercentile: 0.09675
ingestedAt: '2026-07-13T18:57:56.401Z'
---

## Overview

### Impact
A receiver who specifies "--output <dir>" where that output directory currently exists (as a directory).

### Patches
0.24.0 will contain the patch

### Workarounds
Ensure local target directories specified by "--output" do not already exist

### Resources
Private email and Signal communications from a user.
Magic Wormhole thanks  @marduc812

## Affected packages

- `magic-wormhole >= 0.23.0, < 0.24.0`

## Remediation

Upgrade to a patched release:

- `magic-wormhole 0.24.0`