5.3

CVE-2025-54798: raszi node-tmp Link Following

CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2025-54798DEBIAN-CVE-2025-54798DLA-4268-1
Published 07-08-2025Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2025-54798 is a medium (CVSS 5.3) Link Following vulnerability in raszi node-tmp. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 27.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (NVD)
EPSS score
0.36%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 3
CGA-24XQ-H2J3-3X86CGA-6P3X-59VM-9FQ8CGA-P46Q-GGQG-HQ5J

Timeline

  1. 07-08-2025
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

28%

Versus all other CVEs

30-day change

+0.02 pp

From 0.34% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Node Tmp

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard84 products
  • arangodb-3.11< 3.11.14.4-r3
  • arangodb-3.12< 3.12.9.4-r24
  • drupal-11.3< 11.3.13-r3
  • gitlab-rails-ce-18.1All versions (No fix recorded)
  • gitlab-rails-ce-18.5All versions (No fix recorded)
Wolfi24 products
  • jupyter-base-notebook< 7.6.3-r2
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compat< 0.19.0-r40
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
Opensuse2 products
  • python-bqplot&distro=openSUSE Tumbleweed< 0.12.45-13.1
  • python-nbdime&distro=openSUSE Tumbleweed< 4.0.2-23.1
Raszi2 products
Debian1 product
  • node-tmp< 0.2.2+dfsg+~0.2.3-1.1~deb12u1 | < 0.2.2+dfsg+~0.2.3-1.1~deb13u1 | < 0.2.2+dfsg+~0.2.3-1.1 | < 0.2.1+dfsg-1+deb11u1
Npm1 product
  • tmp< 0.2.4
Ubuntu1 product
  • node-tmpAll versions (No fix recorded)

7 vendors · 115 products

References

11 links
Show all 11 references