Executive Summary

CVE-2026-42448 is a path traversal vulnerability in the magic-wormhole tool versions 0.23.0 and earlier. It occurs when a receiver uses the `wormhole receive` command with the `--output` flag pointing to an existing directory. The tool does not properly validate the output path in this case, which can allow files to be written outside the intended directory.

This vulnerability has been fixed in version 0.24.0.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is on data integrity. An attacker could exploit the path traversal issue to modify files outside the intended output directory when receiving files via magic-wormhole.

The vulnerability has a low severity score of 3.5 and requires network access, low privileges, and user interaction to be exploited.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the use of the `wormhole receive` command with the `--output` flag pointing to an existing directory, which can lead to path traversal and unintended file writes outside the intended directory.

To detect if this vulnerability is being exploited or present on your system, you can check for usage of the `wormhole receive` command with the `--output` option targeting directories that already exist.

A possible command to audit recent usage or running processes might be:

• Check running processes for `wormhole receive` usage: `ps aux | grep 'wormhole receive'`
• Search shell history for commands using `--output` with existing directories: `grep -- '--output' ~/.bash_history`

Additionally, monitoring file system changes outside expected directories after running `wormhole receive` could indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade magic-wormhole to version 0.24.0 or later, where this vulnerability has been fixed.

Until the upgrade can be performed, users should ensure that the directory specified with the `--output` flag in the `wormhole receive` command does not already exist as a directory.

This prevents the path traversal issue by avoiding the condition that triggers the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability CVE-2026-42448 in magic-wormhole allows an attacker to perform path traversal, potentially modifying files outside the intended directory. This primarily impacts data integrity.

While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, any compromise of data integrity could have implications for these regulations, which require protection of data accuracy and integrity.

Organizations using affected versions should consider this vulnerability in their risk assessments and remediation plans to maintain compliance with data protection standards.

Useful 0 Not Useful 0