Magic Wormhole Path Traversal Vulnerability in File Transfer Output Directory Specification

A path traversal vulnerability has been identified in Magic Wormhole versions prior to 0.24.0. This issue occurs when a receiver specifies an output directory that already exists as a directory. The vulnerability allows for arbitrary-sized files and directories to be transferred from one computer to another, but with the potential for unintended file overwrites due to the path traversal.

Impact

Exploitation of this vulnerability could lead to unintended file overwrites in the specified output directory, allowing for potential manipulation or loss of data.

Remediation

Users can upgrade to Magic Wormhole version 0.24.0 or later to address this vulnerability. Alternatively, ensure that the local target directory specified with the '--output' option does not already exist as a directory.