Path traversal in node-tmp - CVE-2026-49982
Published: November 9, 2026
Vulnerability identifier: #VU162979
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49982
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to create files or directories outside the intended temporary directory with the application's filesystem privileges.
The vulnerability exists due to missing type validation in node-tmp's path checks when applications forward untrusted non-string prefix, postfix, or template options unchanged. An unauthenticated remote attacker can submit arrays containing traversal sequences that bypass validation and become relative paths during string conversion.
Affected software
node-tmp
How to mitigate CVE-2026-49982
Install security update from vendor's website.
node-tmp - update to 0.2.7