CVE-2026-44705 tmp: Path Traversal via unsanitized prefix/postfix enables directory escape
Attackers can escape the temporary directory and create files in arbitrary locations by injecting path traversal sequences into tmp library options.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44705?
CVE-2026-44705 is a high-severity path traversal vulnerability in raszi node-tmp, published on 11 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.
Weakness: CWE-22
Which versions are affected by CVE-2026-44705?
2 open source packages ship an affected version, including tmp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tmp npm | All versions | 0.2.6 |
tmp npm | All versions | 0.2.6 |
Products include Raszi Tmp.
How do I fix CVE-2026-44705?
Upgrade tmp to 0.2.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44705 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44705 exists.
Other vulnerabilities in raszi node-tmp
Sources
Also known as AZL-89765, CLEANSTART-2026-RI68041, CLSA-2026-1785117460, CLSA-2026-1785117462, CLSA-2026-1785204337, CLSA-2026-1785204339 and 22 more.