Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magic-wormhole | pip | = 0.23.0 | 0.24.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the 'magic-wormhole' file transfer utility and is a path traversal issue. When a user receives a file or directory and specifies an existing directory as the output destination using the --output flag, the application fails to properly sanitize the filename sent by the sender. An attacker can craft a malicious filename containing '..' sequences, which causes the received file to be written outside of the intended destination directory. The analysis of the source code, particularly the src/wormhole/cli/cmd_receive.py file, reveals that the Receiver._decide_destname function is the primary location of the vulnerability. This function constructs the final destination path. The functions Receiver._write_directory and Receiver._extract_file are also implicated as they perform the file extraction and writing operations based on the path determined by _decide_destname. The patch for this vulnerability, as indicated by the commit messages, involves adding stricter checks to prevent path traversal, likely by ensuring that the resolved destination path is always within the intended directory.
