DEBIAN-CVE-2026-44705

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-44705
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44705.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-44705
Upstream
Published
2026-06-11T17:16:33.853Z
Modified
2026-06-26T18:00:08.805183558Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
[none]
Details

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

References

Affected packages

Debian:11 / node-tmp

Package

Name
node-tmp
Purl
pkg:deb/debian/node-tmp?arch=source&distro=bullseye

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.2.1+dfsg-1
0.2.1+dfsg-1+deb11u1
0.2.1+dfsg-2
0.2.1+dfsg+~0.2.2-1
0.2.2+dfsg+~0.2.3-1
0.2.2+dfsg+~0.2.3-1.1~deb12u1
0.2.2+dfsg+~0.2.3-1.1~deb13u1
0.2.2+dfsg+~0.2.3-1.1
0.2.5+dfsg+~0.2.6-1
0.2.5+dfsg+~0.2.6-2
0.2.7+dfsg+~0.2.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44705.json"

Debian:12 / node-tmp

Package

Name
node-tmp
Purl
pkg:deb/debian/node-tmp?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.2.2+dfsg+~0.2.3-1
0.2.2+dfsg+~0.2.3-1.1~deb12u1
0.2.2+dfsg+~0.2.3-1.1~deb13u1
0.2.2+dfsg+~0.2.3-1.1
0.2.5+dfsg+~0.2.6-1
0.2.5+dfsg+~0.2.6-2
0.2.7+dfsg+~0.2.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44705.json"

Debian:13 / node-tmp

Package

Name
node-tmp
Purl
pkg:deb/debian/node-tmp?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.2.2+dfsg+~0.2.3-1
0.2.2+dfsg+~0.2.3-1.1~deb12u1
0.2.2+dfsg+~0.2.3-1.1~deb13u1
0.2.2+dfsg+~0.2.3-1.1
0.2.5+dfsg+~0.2.6-1
0.2.5+dfsg+~0.2.6-2
0.2.7+dfsg+~0.2.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44705.json"

Debian:14 / node-tmp

Package

Name
node-tmp
Purl
pkg:deb/debian/node-tmp?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.2.7+dfsg+~0.2.6-1

Affected versions

0.*
0.2.2+dfsg+~0.2.3-1
0.2.2+dfsg+~0.2.3-1.1~deb12u1
0.2.2+dfsg+~0.2.3-1.1~deb13u1
0.2.2+dfsg+~0.2.3-1.1
0.2.5+dfsg+~0.2.6-1
0.2.5+dfsg+~0.2.6-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44705.json"