PT-2026-29157 · @Tinacms+1 · Tinacms+1

Aarjubh · Published 2026-03-30 · Updated 2026-04-02 · CVE-2026-33949

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tina versions prior to 2.2.2

Description A path traversal vulnerability exists in @tinacms/graphql, allowing unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The impact includes the ability to replace critical server configuration files and potentially execute arbitrary commands by sabotaging build scripts. The vulnerability stems from insufficient path validation in the getValidatedPath function, which fails to correctly handle backslashes as directory separators on non-Windows platforms. An attacker can craft a malicious path, such as x......package.json, to bypass validation and traverse the file system. The affected code areas include the assertWithinBase function in filesystem.ts and the getValidatedPath function in resolver/index.ts.

Recommendations Update to version 2.2.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2026-33949

GHSA-V9P7-GF3Q-H779

Affected Products

@Tinacms/Graphql

Tinacms

References · 5

• https://github.com/tinacms/tinacms/security/advisories/GHSA-v9p7-gf3q-h779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33949 · Security Note
• https://osv.dev/vulnerability/GHSA-v9p7-gf3q-h779 · Vendor Advisory
• https://github.com/tinacms/tinacms · Note
• https://twitter.com/TheHackerWire/status/2039618879425827258 · Twitter Post