SB20261109166 - Path traversal in node-tmp

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109166

SB20261109166 - Path traversal in node-tmp

Published: November 9, 2026

Security Bulletin ID SB20261109166
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: CVE-2026-49982)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to create files or directories outside the intended temporary directory with the application's filesystem privileges.

The vulnerability exists due to missing type validation in node-tmp's path checks when applications forward untrusted non-string prefix, postfix, or template options unchanged. An unauthenticated remote attacker can submit arrays containing traversal sequences that bypass validation and become relative paths during string conversion.


Remediation

Install update from vendor's website.

References