PT-2025-32238 · Tmp+1 · Tmp+1

Dellalibera · Published 2025-08-06 · Updated 2026-06-04 · CVE-2025-54798

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions tmp versions 0.2.3 and below

Description The tmp node.js module versions 0.2.3 and below is susceptible to an arbitrary temporary file/directory write vulnerability due to improper handling of symbolic links when resolving paths. Specifically, the resolvePath function does not adequately address symbolic links, allowing a malicious actor to bypass the intended restrictions on temporary file creation locations. By providing a dir parameter that points to a symbolic link resolving to a directory outside the designated temporary directory, an attacker can write temporary files to arbitrary locations on the system.

Recommendations Update to version 0.2.4 or later to address this vulnerability.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-54798

DLA-4268-1

GHSA-52F5-9888-HMC6

OPENSUSE-SU-2025:15502-1

OPENSUSE-SU-2025:15506-1

Affected Products

Debian

Tmp

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54798.json · Exploit
• 🔥 https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6 · Exploit
• https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b · Patch
• https://github.com/raszi/node-tmp/issues/207 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54798 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54798 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54798 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15506-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54798 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15502-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-52f5-9888-hmc6 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-54798 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-54798 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4268-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-54798 · Vendor Advisory