CVE-2026-24125: @tinacms/graphql Path Traversal Vulnerability
Summary
CVE-2026-24125: @tinacms/graphql has a Path Traversal issue. Affects @tinacms/graphql versions < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinaCMS is an open-source content management system that allows users to create, update, and manage content documents through a user-friendly interface. The @tinacms/graphql package provides GraphQL APIs for these operations, enabling developers to interact with content documents using relative file paths. However, the package is vulnerable to a path traversal issue that can allow unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from the way @tinacms/graphql handles relative file paths during GraphQL mutations. Specifically, the package uses path.join() to combine user-provided paths with the collection path without validating that the resolved path remains within the intended directory. This oversight allows attackers to exploit directory traversal sequences (e.g., ../) to escape the collection root directory. As a result, an authenticated user with document mutation permissions can create, move, delete files, or even create folders outside the designated collection boundaries, leading to potential data exposure or loss.
How To Fix
Minimum fixed version
2.1.2
This is the first release that contains the fix.
npm install @tinacms/graphql@2.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user permissions are tightly controlled, limiting document mutation permissions to trusted users only. Additionally, implement server-side validation to check that any provided relative paths do not contain directory traversal sequences before processing them.
Conclusion
The @tinacms/graphql package has a significant path traversal vulnerability that can be exploited by authenticated users to manipulate files outside the intended directory. It is crucial to update to the patched version 2.1.2 or later to mitigate this risk. Implementing strict user permissions and server-side validation can also help reduce the potential impact.
See every vulnerability recorded for @tinacms/graphql →
FAQ
The vulnerability is a path traversal issue that allows authenticated users to manipulate file paths and access files outside the intended directory.
Any application using the @tinacms/graphql package versions 2.1.1 and below is potentially affected.
An attacker could create, move, delete files, or create folders outside the collection directory, leading to unauthorized access or data loss.
Yes, exploitation requires authenticated access with document mutation permissions, making it less likely for anonymous users to exploit.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for @tinacms/graphql.
