CVE-2026-44705 is a path traversal vulnerability (CWE-22) in the node-tmp package before version 0.2.6. The vulnerability arises when untrusted input is passed to the prefix, postfix, or dir options of tmp's file or directory creation functions without proper sanitization. Attackers can embed path traversal sequences such as '../' to cause files to be created outside the intended temporary directory, potentially at attacker-controlled locations, with the privileges of the process using node-tmp. This can lead to unauthorized file creation or modification. The issue is resolved in version 0.2.6.

An attacker who can supply untrusted input to the tmp package's file or directory creation functions can create files outside the intended temporary directory. This may allow overwriting or creating files in arbitrary locations accessible by the process, potentially leading to privilege escalation or persistent compromise depending on the context in which node-tmp is used. The vulnerability does not require user interaction or privileges to exploit and has a high CVSS 4.0 base score of 7.7.

Upgrade node-tmp to version 0.2.6 or later, where this path traversal vulnerability is fixed. Applications should avoid passing untrusted or unsanitized data to the prefix, postfix, or dir options of tmp's file and directory creation functions. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 0.2.6 as per the description.