PT-2026-25007 · Npm+3 · @Tinacms/Graphql+2
Published
2026-03-12
·
Updated
2026-03-12
·
CVE-2026-24125
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
TinaCMS versions prior to 2.1.2
Description
TinaCMS allows users to create, update, and delete content documents using relative file paths (
relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory. Because path.join() does not prevent directory traversal, paths containing ../ sequences can escape the intended directory boundary. An authenticated user with document mutation permissions can create content files, move or rename files, delete content files, and read file contents outside collection boundaries. Several constraints limit the practical impact of this issue, including schema validation, required authentication, and Git tracking of file operations. The vulnerability can be exploited through GraphQL mutations such as createDocument, updateDocument, deleteDocument, and createFolder. The following API endpoints are involved: /api/graphql. The vulnerable parameters are relativePath and newRelativePath.Recommendations
Update TinaCMS to version 2.1.2 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Tinacms/Graphql
Graphql
Tinacms