REDHAT-BUG-2487946: Path Traversal

Q: Which applications are exposed to this issue?

Applications using tmp before 0.2.6 are affected when untrusted data is passed into the prefix, postfix, or dir options of tmp file or directory creation functions. Applications that do not allow user-controlled values to reach those options are not described as vulnerable.

Q: What does an attacker need to exploit it?

An attacker needs control over data supplied to the prefix, postfix, or dir options. They can use traversal sequences such as ../ or path separators to make tmp create files or directories outside the intended temporary base directory.

Q: What is the impact of successful exploitation?

Files or directories can be created at attacker-controlled locations outside the configured temporary directory. Creation occurs with the privileges of the running process.

Q: What can be done if upgrading is not immediately possible?

Ensure untrusted input cannot flow into the prefix, postfix, or dir options, and sanitize those values to prevent traversal sequences and path separators. Upgrade tmp to version 0.2.6 when possible.

Published Jun 11, 2026

Updated

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

Affected Software

1 affected component

npm/tmp<0.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tmp/npm package to a version that resolves this vulnerability.
Fixed in 0.2.6

Event History

Jun 11, 2026

Data Sourced

via Red Hat·05:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using tmp before 0.2.6 are affected when untrusted data is passed into the prefix, postfix, or dir options of tmp file or directory creation functions. Applications that do not allow user-controlled values to reach those options are not described as vulnerable.

What does an attacker need to exploit it?

An attacker needs control over data supplied to the prefix, postfix, or dir options. They can use traversal sequences such as ../ or path separators to make tmp create files or directories outside the intended temporary base directory.

What is the impact of successful exploitation?

Files or directories can be created at attacker-controlled locations outside the configured temporary directory. Creation occurs with the privileges of the running process.

What can be done if upgrading is not immediately possible?

Ensure untrusted input cannot flow into the prefix, postfix, or dir options, and sanitize those values to prevent traversal sequences and path separators. Upgrade tmp to version 0.2.6 when possible.

REDHAT-BUG-2487946: Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What can be done if upgrading is not immediately possible?