Bug 2487946 (CVE-2026-44705)

Summary:	CVE-2026-44705 tmp: path Traversal via unsanitized prefix/postfix enables directory escape
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abarbaro, akostadi, alizardo, amasferr, amctagga, anthomas, aoconnor, aruklets, aschwart, aszczucz, ataylor, bniver, boliveir, cdrage, cmah, dbruscin, dkeler, dmayorov, doconnor, drichtar, dschmidt, eaguilar, ebaron, ehelms, ehugonne, flucifre, fmariani, ggainey, gmalinko, gmeno, gparvin, groman, janstey, jchui, jhe, jlanda, jlledo, jmatsuok, jpasqual, jtolenti, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lchilton, mbenjamin, mcarlett, mdellweg, mhackett, mhulan, mposolda, mstipich, nboldt, nmoumoul, oaljalju, osousa, pantinor, pcreech, pjindal, psrna, rchan, rexwhite, rhaigner, rhel-process-autobot, rmartinc, rstepani, rushinde, sdawley, sfeifer, simaishi, smallamp, sostapov, ssilvert, stcannon, sthirugn, sthorger, suppawar, tcunning, teagle, thason, tmalecek, tsedmik, vereddy, vmuzikar, watson-tool-maintainers, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2511120, 2511122, 2511124, 2511125, 2511127, 2511128, 2511129, 2511130, 2511132, 2511121, 2511123, 2511126, 2511131
Bug Blocks:

Description OSIDB Bzimport 2026-06-11 17:01:49 UTC

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.