Description
Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| magic-wormhole | magic-wormhole | < 0.24.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-magic-wormhole | 0.24.0-1.1 | openSUSE-SU-2026:11370-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | magic-wormhole | >= 0.23.0, < 0.24.0 | 0.24.0 | GHSA-cf92-gfcw-6v53 |
Advisories 1
- openSUSE-SU-2026:11370-1 python-magic-wormhole-bash-completion-0.24.0-1.1 on GA media SUSE / openSUSE Security Updates · Jul 25, 2026