Vulnerability · Published Mar 12, 2026 · Assigned by GitHub_M
CVE-2026-32116Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
High 8.2
In plain English
A high-severity path traversal in magic-wormhole from magic-wormhole. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | magic-wormhole | 0.23.0 | GHSA-4g4c-mfqg-pj8r |
| PyPI | magic-wormhole | 0.23.0 | PYSEC-2026-2615 |
| Ubuntu:22.04:LTS | magic-wormhole | no fix listed | UBUNTU-CVE-2026-32116 |
| Ubuntu:24.04:LTS | magic-wormhole | no fix listed | UBUNTU-CVE-2026-32116 |
| Ubuntu:25.10 | magic-wormhole | no fix listed | UBUNTU-CVE-2026-32116 |
| Ubuntu:26.04:LTS | magic-wormhole | no fix listed | UBUNTU-CVE-2026-32116 |
| Ubuntu:26.10 | magic-wormhole | no fix listed | UBUNTU-CVE-2026-32116 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| magic-wormhole | magic-wormhole | >= 0.21.0, < 0.23.0 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N