CVE-2026-44705

tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

Arbitrary File Creation:

• Files created outside intended temporary directories
• Attacker control over file placement location
• Potential to overwrite existing files (depending on creation flags)
• Cross-platform exploitation capability

Attack Scenarios:

1. Web Application Configuration Poisoning:

• User uploads file with malicious prefix/postfix
• tmp creates "temporary" file in application configuration directory
• Malicious configuration loaded on next application restart

2. Cache Poisoning:

• Application caches user content using tmp
• Attacker escapes to cache directory of different user/tenant
• Poisoned cache serves malicious content to other users

3. Build Pipeline Compromise:

• CI/CD system processes user PRs with tmp usage
• Malicious prefix escapes to build output directories
• Compromised build artifacts deployed to production

4. Container Escape Attempt:

• Containerized application uses tmp with user input
• Attacker attempts to escape container temp restrictions
• Files created in host-mapped volumes or sensitive container areas

5. Multi-Tenant Service Bypass:

• SaaS platform isolates tenants using separate tmp directories
• Tenant A escapes their tmp space to tenant B's area
• Cross-tenant data access and potential privilege escalation

Business Impact:

• Data Integrity: Unauthorized file placement can corrupt application state
• Service Disruption: Files in wrong locations may break application functionality
• Security Bypass: Escape temporary isolation boundaries
• Compliance Violations: Files containing sensitive data placed in uncontrolled locations

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

1. What is CVE-2026-44705? CVE-2026-44705 is a high-severity path traversal vulnerability in tmp (npm), affecting versions < 0.2.6. It is fixed in 0.2.6. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which versions of tmp are affected by CVE-2026-44705? tmp (npm) versions < 0.2.6 is affected.
3. Is there a fix for CVE-2026-44705? Yes. CVE-2026-44705 is fixed in 0.2.6. Upgrade to this version or later.
4. Is CVE-2026-44705 exploitable, and should I be worried? Whether CVE-2026-44705 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-44705 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-44705? Upgrade tmp to 0.2.6 or later.