CVE-2026-44705

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

• CWE-22

• https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65Exploit, Mitigation, Vendor Advisory
• https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65Exploit, Mitigation, Vendor Advisory

Published

Jun 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44696OpenProject is open-source, web-based project management sof…5.7
• CVE-2026-44697Klever-Go is the Go implementation of the Klever blockchain …8.6
• CVE-2026-44698Home Assistant is open source home automation software that …8.3
• CVE-2026-44699LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, l…9.1
• CVE-2026-4470A security flaw has been discovered in itsourcecode Online F…9.8
• CVE-2026-44700Elixir WebRTC is an Elixir implementation of the W3C WebRTC …8.7
• CVE-2026-44706Chatwoot is a customer engagement suite. From 2.2.0 to befor…8.5
• CVE-2026-44707Chatwoot is a customer engagement suite. From 2.14.0 to befo…6.8
• CVE-2026-44708Mistune is a Python Markdown parser with renderers and plugi…6.1
• CVE-2026-44709pam_usb provides hardware authentication for Linux using ord…7.8
• CVE-2026-4471A weakness has been identified in itsourcecode Online Frozen…9.8
• CVE-2026-44710pam_usb provides hardware authentication for Linux using ord…4.6