GHSA-ph9p-34f9-6g65: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
SummaryThe tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the `prefix`, `postfix`, or `dir` options. By embedding traversal sequences (e.g., `../`) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization.Details**Root Cause:**
The vulnerability exists in tmp's path construction logic where user-supplied options are directly concatenated into file paths without sanitization or validation.**Technical Flow:****Filename Construction:** tmp builds filenames as `<prefix>-<pid>-<random>-<postfix>`**Path Composition:** Final path computed as `path.join(tmpDir, opts.dir, name)`**Path Normalization:** Node.js `path.join()` normalizes traversal sequences, allowing escape**File Creation:** File created at the resulting (potentially escaped) path**Vulnerable Pattern:****Path Traversal Mechanics:****prefix/postfix traversal:** `../../../evil` in prefix escapes directory structure**Absolute path bypass:** If `opts.dir` is absolute, `path.join()` ignores `tmpDir` completely**Normalization exploitation:** `path.join()` resolves `../` sequences regardless of surrounding text**Cross-platform impact:** Works on Windows (`..\\`), Unix (`../`), and mixed path systems**Key Vulnerability Points:**No input validation on `prefix`, `postfix`, or `dir` parametersDirect use of user input in path constructionReliance on `path.join()` normalization without containment checksMissing post-construction validation that final path remains within intended directoryPoC**Basic Path Traversal via prefix:****Directory Escape via postfix:****Absolute Path Bypass via dir:****Advanced Multi-Vector Attack:****Real-World Attack Simulation:**Impact**Arbitrary File Creation:**Files created outside intended temporary directoriesAttacker control over file placement locationPotential to overwrite existing files (depending on creation flags)Cross-platform exploitation capability**Attack Scenarios:****1. Web Application Configuration Poisoning:**User uploads file with malicious prefix/postfixtmp creates "temporary" file in application configuration directoryMalicious configuration loaded on next application restart**2. Cache Poisoning:**Application caches user content using tmpAttacker escapes to cache directory of different user/tenantPoisoned cache serves malicious content to other users**3. Build Pipeline Compromise:**CI/CD system processes user PRs with tmp usageMalicious prefix escapes to build output directoriesCompromised build artifacts deployed to production**4. Container Escape Attempt:**Containerized application uses tmp with user inputAttacker attempts to escape container temp restrictionsFiles created in host-mapped volumes or sensitive container areas**5. Multi-Tenant Service Bypass:**SaaS platform isolates tenants using separate tmp directoriesTenant A escapes their tmp space to tenant B's areaCross-tenant data access and potential privilege escalation**Business Impact:****Data Integrity:** Unauthorized file placement can corrupt application state**Service Disruption:** Files in wrong locations may break application functionality**Security Bypass:** Escape temporary isolation boundaries**Compliance Violations:** Files containing sensitive data placed in uncontrolled locationsAffected Products**Ecosystem:** npm**Package name:** tmp**Repository:** github.com/raszi/node-tmp**Affected versions:** All versions with vulnerable path construction logic**Patched versions:** None currently available**Component Impact:**`tmp.file()` function - vulnerable to prefix/postfix/dir traversal`tmp.dir()` function - vulnerable to same parameter manipulation`tmp.tmpName()` function - if using affected path construction**Severity:** High  
**CVSS v3.1:** 8.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)**CWE Classification:**CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)Remediation**Input Validation and Sanitization:****Sanitize prefix/postfix:****Validate dir parameter:****Post-construction path validation:****Secure Implementation Pattern:**Workarounds**For Application Developers:****Input Sanitization:****Path Validation:****Restricted Usage:****For Security Teams:****Code Review Patterns:****Runtime Monitoring:**Detection and Monitoring**Static Analysis:**Scan for tmp usage with user-controlled inputIdentify unsanitized parameter passing to tmp functionsReview file creation patterns in temporary directories**Runtime Detection:****File System Monitoring:**Acknowledgements**Reported by**: Mapta / BugBunny_ai
CVSS v4.0: 7.7