Directory Traversal The advisory has been revoked - it doesn't affect any version of package subscription-manager-plugin-ostree (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CENTOS7-SUBSCRIPTIONMANAGERPLUGINOSTREE-18544924
- published5 Aug 2026
- disclosed11 Jun 2026
Introduced: 11 Jun 2026
CVE-2026-44705 (opens in a new tab)Amendment
The Centos security team deemed this advisory irrelevant for Centos:7.
NVD Description
Note: Versions mentioned in the description apply only to the upstream subscription-manager-plugin-ostree package and not the subscription-manager-plugin-ostree package as distributed by Centos.
tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.