{"id":"EUVD-2026-36265","enisaUuid":"b78d2d37-9159-3ac9-8595-13a1fa60ba70","description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes(\u0027..\u0027) returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process\u0027s privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]\u003d...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","datePublished":"Jun 11, 2026, 3:45:00 PM","dateUpdated":"Jun 11, 2026, 6:24:22 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm\n","aliases":"CVE-2026-49982\nGHSA-7c78-jf6q-g5cm\n","assigner":"GitHub_M","epss":0.5,"enisaIdProduct":[{"id":"49e9fd5e-abe2-388e-a38d-f2f9c68ced35","product":{"name":"node-tmp","vendor":{"name":"raszi"}},"product_version":"0.2.6"}],"enisaIdVendor":[{"id":"c7b2c183-c204-3d1a-9998-2a9790a2ab02","vendor":{"name":"raszi"}}],"enisaIdVulnerability":[{"id":"1891bd4f-12fa-3fa5-be96-5a01ee19d9d3","vulnerability":{"id":"GHSA-7c78-jf6q-g5cm","description":"tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template","datePublished":"Jun 15, 2026, 4:36:46 PM","dateUpdated":"Jun 15, 2026, 4:36:46 PM","baseScore":0.0,"references":"https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49982\nhttps://github.com/raszi/node-tmp\n","enisa_id":"EUVD-2026-36265\n","aliases":"CVE-2026-49982\nGHSA-7c78-jf6q-g5cm\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ef61ef6b-8411-3190-bd8d-8dfbdf19dc2e","vulnerability":{"id":"CVE-2026-49982","description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes(\u0027..\u0027) returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process\u0027s privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]\u003d...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","datePublished":"Jun 11, 2026, 3:45:00 PM","dateUpdated":"Jun 11, 2026, 6:24:22 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm\n","enisa_id":"EUVD-2026-36265\n","assigner":"GitHub_M","epss":0.5,"dataProcessed":"Oct 28, 2026, 7:18:26 AM","vulnerabilityProduct":[{"id":"d0a41962-b7fd-3445-8039-dd4cc61f13ea","product":{"name":"node-tmp","vendor":{"name":"raszi"}},"product_version":"0.2.6"}],"vulnerabilityVendor":[{"id":"fa4b66ab-0a63-3e85-bd4f-114cca89736d","vendor":{"name":"raszi"}}]}}],"enisaIdAdvisory":[]}