CVE-2026-33949
CVE-2026-33949 · @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The impact includes the ability to replace critical server configuration files and potentially execute arbitrary commands by sabotaging build script. This issue has been patched in version 2.2.2.
CVSS 8.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
tinacms
- Versions
- < 2.2.2: Affected
No fix published
@tinacms/graphql npm
- Affected ranges
- SEMVER: < 2.2.2
Update to 2.2.2