7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44705

CVE-2026-44705: tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44705

CVE-2026-44705:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tmp	npm	< 0.2.6	0.2.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal in the tmp npm package, affecting versions prior to 0.2.6. The root cause was the lack of input sanitization for the prefix, postfix, and dir options provided to the main functions of the library: file(), dir(), and tmpName(). An attacker could provide path traversal sequences (e.g., ../) in these options, which were then used to construct a file or directory path. The Node.js path.join() function would normalize these paths, allowing the final location to be outside the intended temporary directory, leading to arbitrary file/directory creation.

The analysis of the patch commit efa4a06f24374797ae32ab2b6ae39b7a611ae429 confirms this. The fix involves two key changes to internal helper functions:

A new function, _assertPath(), was added to explicitly block any strings containing .. from being used in prefix and postfix. This validation is enforced in the _assertOptionsBase() function, which prepares options for the public API calls.
The validation logic within _getRelativePath() and _getRelativePathSync() was corrected. The previous, insufficient check was replaced with a robust method that verifies that the path specified in the dir option does not resolve to a location outside of the base temporary directory.

During exploitation, a runtime profiler would capture a stack trace originating from a call to one of the public functions (file, dir, or tmpName) and proceeding through the internal helper functions (_assertOptionsBase, _getRelativePath, etc.) where the vulnerable logic resided. Therefore, both the public entry points and the internal functions with flawed logic are identified as key indicators of this vulnerability.

Vulnerable functions

_assertOptionsBase

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.