Magic Wormhole EUVD-2026-31947

Magic Wormhole is a Python-based secure file transfer utility that uses a rendezvous server and SPAKE2 key exchange to establish encrypted channels between sender and receiver. The vulnerability exists in the receive command's handling of the '--output' parameter (CPE: pkg:pip/magic-wormhole). The root cause is a path traversal flaw (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) where the application fails to properly validate that file writes remain within the intended output directory when that directory pre-exists. The issue manifests when a receiver specifies an existing directory as the output target, allowing the sender to craft a transfer with embedded path traversal sequences (e.g., '../') that cause files to be written to arbitrary locations on the receiver's filesystem, bypassing the intended directory containment.