CVE-2026-42448CWE-22

wormhole receive, with --output pointing at an existing directory can be path-traversed

Low · published May 26, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-26T17:57Z
EPSS history
Timeline
  • 26 MAY 17:57Z
    wormhole receive, with --output pointing at an existing directory can be path-traversed
    cvelistv5