What is GHSA-cf92-gfcw-6v53?

GHSA-cf92-gfcw-6v53 is a security advisory published by GitHub Security Advisories with Low severity. Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed

Which CVE IDs does GHSA-cf92-gfcw-6v53 cover?

GHSA-cf92-gfcw-6v53 covers the following CVE IDs: CVE-2026-42448. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cf92-gfcw-6v53?

GHSA-cf92-gfcw-6v53 has a CVSS v3 base score of 3.5, published by GitHub Security Advisories.

Which products are affected by GHSA-cf92-gfcw-6v53?

GHSA-cf92-gfcw-6v53 affects 1 product, including: pip/magic-wormhole:= 0.23.0.

GHSA-cf92-gfcw-6v53LowCVSS 3.5

Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed

Vendor

GitHub Security Advisories

Published

May 6, 2026

Last Modified

June 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-42448 →

📋 Description

Impact

A receiver who specifies "--output " where that output directory currently exists (as a directory).

Patches

0.24.0 will contain the patch

Workarounds

Ensure local target directories specified by "--output" do not already exist

Resources

Private email and Signal communications from a user. Magic Wormhole thanks @marduc812

🎯 Affected products1

pip/magic-wormhole:= 0.23.0

🔗 References (3)

https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53
https://nvd.nist.gov/vuln/detail/CVE-2026-42448
https://github.com/advisories/GHSA-cf92-gfcw-6v53