What is the CVSS score of CVE-2026-32116?

CVE-2026-32116 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Magic Wormhole are affected by CVE-2026-32116?

Magic Wormhole versions 0.21.0 through 0.23.0 contain a critical path traversal vulnerability that could allow attackers to read or write files outside intended directories on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-32116?

Within 24 hours: Identify all systems running Magic Wormhole versions 0.21.0-0.23.0 and assess current usage patterns. Within 7 days: Implement network segmentation to restrict Magic Wormhole traffic to trusted endpoints only and disable the application if not operationally critical. Within 30 days: Migrate to an alternative secure file transfer solution or upgrade to a patched version once available; monitor vendor communications for patch release.

Magic Wormhole CVE-2026-32116

EUVD-2026-11643 HIGH

Path Traversal (CWE-22)

2026-03-12 security-advisories@github.com

GHSA-4g4c-mfqg-pj8r

Path Traversal Magic Wormhole

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 12, 2026 - 19:57 euvd

EUVD-2026-11643

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 18:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.

AnalysisAI

Magic Wormhole versions 0.21.0 through 0.22.x allow malicious senders to overwrite arbitrary files on a receiver's system during file transfer operations, potentially compromising SSH keys and shell configuration files. This path traversal vulnerability (CWE-22) requires the attacker to control the sending side of the transfer and affects any user receiving files from an untrusted source. No patch is currently available for this HIGH severity vulnerability.

Technical ContextAI

This vulnerability (CWE-22: Path Traversal) affects Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to. Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded