Threat Intelligence Database

A vulnerability in node-tmp version 0.2.6 allows improper input validation leading to directory traversal. The _assertPath guard fails to block non-string inputs that can be coerced into paths escaping the intended temporary directory. This enables attackers to create files or directories at arbitrary locations with the host process's privileges. The issue is fixed in version 0.2.7.

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.