Arbitrary File Write Vulnerability in Node.js Temporary File Creator
CVE-2025-54798

2.5LOW

Key Information:

Vendor

Raszi

Status
Node-tmp
Vendor
CVE Published:
7 August 2025

What is CVE-2025-54798?

The 'tmp' package for Node.js, used to create temporary files and directories, is susceptible to an arbitrary file or directory write vulnerability. This flaw exists due to improper handling of symbolic link directory parameters in versions up to 0.2.3. When exploited, an attacker could potentially specify a malicious directory, leading to unauthorized data manipulation or exposure. Users should upgrade to version 0.2.4 to mitigate this risk.

Affected Version(s)

node-tmp < 0.2.4

References

https://github.com/raszi/node-tmp/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/raszi/node-tmp/issues/207
x_refsource_MISC
https://github.com/raszi/node-tmp/commit/188b25e529496e37...
x_refsource_MISC

CVSS V3.1

Score:
2.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2025-54798 : Arbitrary File Write Vulnerability in Node.js Temporary File Creator