CVE-2026-49982 Details
Description
tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.
A path traversal vulnerability has been identified in the Node.js tmp package, specifically in version 0.2.6. The issue arises from the _assertPath function, which is intended to validate path inputs by rejecting non-string values that contain the substring '..'. However, this guard can be bypassed when the prefix, postfix, or template options are provided as non-string values, such as arrays or buffers, that do not explicitly include '..' but still stringify to a value containing '../'. Exploiting this vulnerability allows an attacker to create files or directories outside the intended temporary directory, using the privileges of the host process. This issue affects any application that passes untrusted data into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without proper type validation.
Users can upgrade to tmp version 0.2.7, which addresses the vulnerability by enforcing string type requirements for the prefix, postfix, and template options.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| raszi tmp | 0.2.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |