CVE-2025-54798

MEDIUM EPSS 22.5%
Published Aug 7, 202510mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Aug 7, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
22.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-59

Affected Products 1

VendorProductVersionRange
raszitmp* <0.2.4

References 4

  • github.com https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b
    Patch
  • github.com https://github.com/raszi/node-tmp/issues/207
    Issue TrackingPatch
  • github.com https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6
    ExploitVendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html

Remediation

  • github.com https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b
    Patch
  • github.com https://github.com/raszi/node-tmp/issues/207
    Issue TrackingPatch