CVE-2026-49982: tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template

Synopsis

A type-confusion path-traversal vulnerability exists in the tmp package (node-tmp) version 0.2.6, a temporary file and directory utility for Node.js. The flaw is reachable over the network with no authentication required when an application forwards untrusted input directly into tmp's file or directory creation functions. Successful exploitation lets an attacker write files or create directories at arbitrary locations on the host filesystem, using the privileges of the running process. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is exposed over the network (AV:N): an attacker must be able to send HTTP requests (or other network input) to an application that passes untrusted fields into tmp functions.

• AuthenticationNot required

  No credentials are needed (PR:N): any unauthenticated request carrying a crafted prefix, postfix, or template value is sufficient to trigger the bypass.

• Victim interactionNot required

  No victim action is required (UI:N): the exploit completes server-side when the application processes the attacker's input, with no user click or navigation needed.

• Attack complexityDetail

  Attack complexity is low (AC:L): no race conditions, memory-layout knowledge, or special environmental factors are required; the bypass is reliable and repeatable against any unpatched application that forwards unsanitized input to tmp.

Blast Radius

• An attacker writes files or creates directories at arbitrary locations on the host filesystem, bounded only by the privileges of the Node.js process.
• Sensitive locations such as cron directories, shell init files, or application configuration paths can be overwritten or seeded with attacker-controlled content.
• Persistent backdoors or malicious scripts can be planted if any writable location is later executed or loaded by the process or the operating system.
• Service availability is partially disrupted (A:L per CVSS): filling or corrupting filesystem paths can degrade normal application operation or cause partial failures.