Executive brief
Magic Wormhole is a tool used to securely transfer files and directories between computers. A vulnerability exists where an attacker can perform a path traversal attack if the receiver specifies an existing directory as the output location. This could allow an attacker to write files to unintended locations on the receiver's system, potentially overwriting important data.
Technical details
A path traversal vulnerability (CWE-22) exists in Magic Wormhole version 0.23.0. The issue occurs during the 'receive' process when a user specifies an existing directory via the '--output' argument. An attacker can exploit this to write files to locations outside of the specified directory. The attack requires network connectivity and user interaction (the receiver must initiate the transfer and specify the vulnerable output path). The vulnerability is addressed in version 0.24.0. As a workaround, users should ensure that the target directory specified by '--output' does not already exist.
Affected products
- Magic Wormhole magic-wormhole 0.23.0
Timeline
- 2026-05-05: disclosed
- 2026-05-05: advisory
- 2026-05-06: other: Published to GitHub Advisory Database
- 2026-05-26: other: Published to NVD