Skip to content
Fencer Intel
high 8.2

CVE-2026-44705 json

tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

published 5mo ago modified 14d ago also EUVD-2026-36264 , GHSA-ph9p-34f9-6g65

cvss
8.2
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

Patch / fix

  • npm tmp 0.2.6
  • raszi tmp 0.2.6
  • node-tmp Debian 14 0.2.7+dfsg+~0.2.6-1

debian advisories DEBIAN-CVE-2026-44705

  • python3.12-django ansible automation platform developer 2.5, ansible automation platform 2.5 5.2.17-1.el8ap
  • python3.12-django ansible automation platform developer 2.6, ansible automation platform developer 2.5, ansible automation platform 2.6 +1 more 5.2.17-1.el9ap
  • python3.12-aiohttp ansible automation platform 2.5 3.14.3-1.el8ap
  • python3.12-aiohttp ansible automation platform 2.6, ansible automation platform 2.5 3.14.3-1.el9ap
  • python3.12-gitpython ansible automation platform 2.5 3.1.59-1.el8ap
  • python3.12-gitpython ansible automation platform 2.6, ansible automation platform 2.5 3.1.59-1.el9ap
  • automation-controller-cli ansible automation platform developer 2.5, ansible automation platform 2.5 4.6.32-1.el8ap
  • automation-controller-cli ansible automation platform developer 2.5, ansible automation platform 2.5 4.6.32-1.el9ap

red hat advisories RHSA-2026:59135RHSA-2026:59136RHSA-2026:57590

Is CVE-2026-44705 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-44705 updated cvss 8.2

tmp: path Traversal via unsanitized prefix/postfix enables directory escape

  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git
    affected: workaround, no fix available
  • Red Hat Ceph Storage 9 rhceph/alloy-rhel10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 5 openshift5/ose-agent-installer-ui-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 tmp
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1787047114
    fixed: vendor fix RHSA-2026:56338
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260824-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260824-1.el9ap
    fixed: vendor fix RHSA-2026:59135
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1787219751
    fixed: vendor fix RHSA-2026:59155
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.13-1.el9ap
    fixed: vendor fix RHSA-2026:59136
show 22 more
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1787218409
    fixed: vendor fix RHSA-2026:59153
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.2-1.el10_2
    fixed: vendor fix RHSA-2026:57590
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-mod-arch-model-registry-rhel9 1791853432
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1787347991, rhoai/odh-mod-arch-maas-rhel9 1787251250, rhoai/odh-mod-arch-automl-rhel9 1787250508, rhoai/odh-mod-arch-gen-ai-rhel9 1786611759, rhoai/odh-mod-arch-mlflow-rhel9 1786612219, rhoai/odh-mod-arch-autorag-rhel9 1787251550, +2 more
    fixed: vendor fix RHSA-2026:60520
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-agent-installer-ui-rhel9 1789001239
    fixed: vendor fix RHSA-2026:66377
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-agent-installer-ui-rhel9 1788928423
    fixed: vendor fix RHSA-2026:66352
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-agent-installer-ui-rhel9 1788954174
    fixed: vendor fix RHSA-2026:66358
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/code-rhel9 1787762793, devspaces/openvsx-rhel9 1787759145, devspaces/pluginregistry-rhel9 1787759723
    fixed: vendor fix RHSA-2026:62260
  • Red Hat Quay 3.9 quay/quay-rhel8 1788595574
    fixed: vendor fix RHSA-2026:65514
  • Red Hat Quay 3.10 quay/quay-rhel8 1788561841
    fixed: vendor fix RHSA-2026:66084
  • Red Hat Quay 3.12 quay/quay-rhel8 1788594376
    fixed: vendor fix RHSA-2026:66523
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1788191755
    fixed: vendor fix RHSA-2026:63307
  • Red Hat Quay 3.16 quay/quay-rhel9 1789563753
    fixed: vendor fix RHSA-2026:69255
  • Red Hat Quay 3.17 quay/quay-rhel9 1790690298
    fixed: vendor fix RHSA-2026:74511
  • Red Hat Quay 3.18 quay/quay-rhel9 1791265590
    fixed: vendor fix RHSA-2026:81110
  • Red Hat Satellite 6.18 satellite/iop-remediations-rhel9 1789615095
    fixed: vendor fix RHSA-2026:68766
  • Red Hat Satellite 6.19 satellite/iop-remediations-rhel9 1789615593
    fixed: vendor fix RHSA-2026:68747
  • Red Hat Cryostat 4 tmp, cryostat-openshift-console-plugin-npm
    not affected: component not present
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9
    not affected: vulnerable code not present
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat 3scale API Management Platform 2 3scale-amp21/system, 3scale-amp22/system, 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9
    not affected: component not present
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9 Red Hat AMQ Broker 7 amq-broker-bin.zip, amq-broker-maven-repository.zip Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-hub 4.10.18-1.el8ap, python3.12-django 5.2.17-1.el8ap, python3.12-aiohttp 3.14.3-1.el8ap, python3.12-gitpython 3.1.59-1.el8ap, automation-controller 4.6.32-1.el8ap, python3.12-galaxy-ng 4.10.18-1.el8ap, +11 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-hub 4.10.18-1.el9ap, python3.12-django 5.2.17-1.el9ap, python3.12-aiohttp 3.14.3-1.el9ap, python3.12-gitpython 3.1.59-1.el9ap, automation-controller 4.6.32-1.el9ap, python3.12-galaxy-ng 4.10.18-1.el9ap, +11 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1787220598, ansible-automation-platform-26/hub-web-rhel9 1787224278, ansible-automation-platform-26/receptor-rhel9 1787202412, ansible-automation-platform-26/mcp-tools-rhel9 1787219369, ansible-automation-platform-26/controller-rhel9 1787244009, ansible-automation-platform-26/de-minimal-rhel9 1787223306, +24 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 molecule 26.8.0-1.el9ap, ansible-lint 26.8.0-1.el9ap, python3.12-nh3 0.3.6-1.el9ap, ansible-creator 26.8.0-1.el9ap, automation-hub 4.11.13-1.el9ap, ansible-dev-tools 26.8.0-1.el9ap, +37 more
    not affected: vulnerable code not present

26 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
4mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Affected packages

ecosystem package affected fixed in
npm tmp
<0.2.6
0.2.6

Affected products

  • raszi node-tmp

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.