CVE-2026-32116CWE-22

Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

High · published March 12, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-12T17:40Z
EPSS history
Timeline
  • 12 MAR 17:40Z
    Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
    cvelistv5