CVE-2026-42448
BaseFortify
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| magic_wormhole | magic_wormhole | to 0.24.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-42448 is a path traversal vulnerability in the magic-wormhole tool versions 0.23.0 and earlier. It occurs when a receiver uses the `wormhole receive` command with the `--output` flag pointing to an existing directory. The tool does not properly validate the output path in this case, which can allow files to be written outside the intended directory.
This vulnerability has been fixed in version 0.24.0.
How can this vulnerability impact me? :
The primary impact of this vulnerability is on data integrity. An attacker could exploit the path traversal issue to modify files outside the intended output directory when receiving files via magic-wormhole.
The vulnerability has a low severity score of 3.5 and requires network access, low privileges, and user interaction to be exploited.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the use of the `wormhole receive` command with the `--output` flag pointing to an existing directory, which can lead to path traversal and unintended file writes outside the intended directory.
To detect if this vulnerability is being exploited or present on your system, you can check for usage of the `wormhole receive` command with the `--output` option targeting directories that already exist.
A possible command to audit recent usage or running processes might be:
- Check running processes for `wormhole receive` usage: `ps aux | grep 'wormhole receive'`
- Search shell history for commands using `--output` with existing directories: `grep -- '--output' ~/.bash_history`
Additionally, monitoring file system changes outside expected directories after running `wormhole receive` could indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade magic-wormhole to version 0.24.0 or later, where this vulnerability has been fixed.
Until the upgrade can be performed, users should ensure that the directory specified with the `--output` flag in the `wormhole receive` command does not already exist as a directory.
This prevents the path traversal issue by avoiding the condition that triggers the vulnerability.