File overwrite via omitted receiver basename

Path traversal in Magic Wormhole 0.23.0 allows remote authenticated users to write received files outside an existing output directory. When --output names an existing directory, the receive path joins it with the sender-controlled filename without first reducing that name to its basename. Exploitation requires the receiver to enter the sender's wormhole code, select an existing directory, and accept the transfer; the resulting write alters local file integrity.