Read the docs
TI-2026-32592 Aliases CVE-2026-44705GHSA-ph9p-34f9-6g65

tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

Priority HIGH 69CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 23 fixed, 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial node-tmp (raszi): 0.2.6tmp (npm): 0.2.6Red Hat: 23 advisoriesRed Hat: 23 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
raszinode-tmpbefore 0.2.60.2.6Patch availableCNA
—tmp (npm)before 0.2.60.2.6Patch availableGHSA-ph9p-34f9-6g65
  • node-tmp Vendorraszi Affected before 0.2.6 Fixed in 0.2.6 Patch available CNA
  • tmp (npm) Vendor— Affected before 0.2.6 Fixed in 0.2.6 Patch available GHSA-ph9p-34f9-6g65

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:raszi:tmp:*:*:*:*:*:node.js:*:*before 0.2.6Vulnerableraszi
  • cpe:2.3:a:raszi:tmp:*:*:*:*:*:node.js:*:* Versions before 0.2.6 Vulnerable ·raszi

Remediation

  • Fix · CNA node-tmp (raszi) Fixed in 0.2.6
  • Fix · GHSA-ph9p-34f9-6g65 tmp (npm) Fixed in 0.2.6 Advisory →

Red Hat 23 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:81110 Released 2026-10-12 · Red Hat rating Important
    Red Hat Quay 3.18.1
    • Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
Show 20 more Red Hat advisories
  • RHSA-2026:74511 Released 2026-10-01 · Red Hat rating Important
    Red Hat Quay 3.17.5
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:68766 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:68747 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:66358 Released 2026-09-15 · Red Hat rating Important
    OpenShift Container Platform 4.22.14 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/aws-node-termination-handler-rhel9 +47
  • RHSA-2026:66377 Released 2026-09-15 · Red Hat rating Important
    OpenShift Container Platform 4.20.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:66352 Released 2026-09-15 · Red Hat rating Important
    OpenShift Container Platform 4.21.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:66523 Released 2026-09-10 · Red Hat rating Important
    Red Hat Quay 3.12.22
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:66084 Released 2026-09-09 · Red Hat rating Important
    Red Hat Quay 3.10.26
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:65514 Released 2026-09-08 · Red Hat rating Important
    Red Hat Quay 3.9.26
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:63307 Released 2026-09-03 · Red Hat rating Important
    Red Hat Quay 3.15.8
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:59155 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +5
  • RHSA-2026:59153 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +3
  • RHSA-2026:59136 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-django-5.2.17-1.el10ap, python3-django-5.2.17-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-cli-4.7.16-1.el9ap, automation-controller-venv-tower-4.7.16-1.el9ap, automation-platform-ui-2.6.13-1.el9ap +3
  • RHSA-2026:59135 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-cli-4.6.32-1.el8ap, automation-controller-venv-tower-4.6.32-1.el8ap, automation-gateway-server-2.5.20260824-1.el8ap +3
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-cli-4.6.32-1.el9ap, automation-controller-venv-tower-4.6.32-1.el9ap, automation-gateway-server-2.5.20260824-1.el9ap +3
  • RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Important
    rh-podman-desktop security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
  • RHSA-2026:56338 Released 2026-08-18 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Node HealthCheck OperatorAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:56338
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:59135
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:59135
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:59155
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:59136
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:59153
Red Hat Enterprise Linux Extensions Channel (v. 10)Fixed RHSA-2026:57590
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:66377
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:66352
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:66358
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat Quay 3.10Fixed RHSA-2026:66084
Red Hat Quay 3.12Fixed RHSA-2026:66523
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:63307
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Quay 3.17Fixed RHSA-2026:74511
Red Hat Quay 3.18Fixed RHSA-2026:81110
Red Hat Quay 3.9Fixed RHSA-2026:65514
Red Hat Satellite 6.18Fixed RHSA-2026:68766
Red Hat Satellite 6.19Fixed RHSA-2026:68747
Not affected: 37 products
  • Cryostat 4
  • Multicluster Engine for Kubernetes
  • OpenShift Pipelines
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.18
  • Red Hat Quay 3.9
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44705
  2. 2026-10-03 Alias added: GHSA-ph9p-34f9-6g65
  3. 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
  4. 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
  5. 2026-10-16 Affected versions changed · Red Hat
  6. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  7. 2026-10-20 Affected versions changed · Red Hat
  8. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  9. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
  10. 2026-10-27 Affected versions changed · Red Hat
  11. 2026-10-30 Affected versions changed · Red Hat

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-36815 tmp: Type-confusion bypass of _assertPath in [email protected] allows path traversal via non-string prefix/postfix/template CVSS 3.1HIGH 8.2
  • TI-2025-34552 tmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameter CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences