CVE-2026-44705: tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

Synopsis

Path traversal vulnerability in the tmp npm package (raszi/node-tmp) allows an attacker to escape the intended temporary directory by injecting traversal sequences (such as ../) into the prefix, postfix, or dir options passed to tmp's file and directory creation functions. The vulnerability is reachable over the network with no authentication required, and affects any Node.js application that passes user-controlled input into these options without sanitizing it first. Successful exploitation lets the attacker write files to arbitrary locations on the host filesystem with the privileges of the running process. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the vulnerable service over the network to supply malicious input to the tmp options.

• AuthenticationNot required

  No account or credential is needed; the vulnerability is exploitable by any unauthenticated caller who can reach the service.

• Victim interactionNot required

  No user action is required; the exploit is triggered entirely by the attacker supplying crafted input to the application.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other variable environmental factors.

Blast Radius

• The attacker writes files to arbitrary locations outside the configured temporary directory, constrained only by the filesystem permissions of the running process.
• In a containerized workload running as root or with broad write permissions, this enables overwriting configuration files, scripts, or other application assets on the host or shared volumes.
• Confidentiality impact is high: because file paths are attacker-controlled, the attacker can place files where they will be read or executed by other processes, enabling indirect exfiltration or privilege escalation depending on application behavior.
• Integrity of the host filesystem is at risk for any path the process user can write to, including application code directories if mounted with write access.