CVE-2026-33949: Path Traversal Vulnerability in @tinacms/graphql Allows Arbitrary File Overwrites
Summary
CVE-2026-33949: @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files. Affects @tinacms/graphql versions < 2.2.2. Fixed in 2.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @tinacms/graphql package is a GraphQL API for TinaCMS, a content management system that enables developers to build and manage content-driven applications. This package facilitates interactions with the filesystem, allowing users to create, read, update, and delete documents. However, it has a critical vulnerability that exposes it to path traversal attacks, enabling unauthorized file access and modifications.
Vulnerability Detail
A Path Traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is due to improper validation of the 'relativePath' parameter in GraphQL mutations, which fails to recognize backslashes as directory separators on non-Windows platforms. An attacker can exploit this by sending a crafted path like 'x......\package.json', leading to the potential replacement of critical files and execution of arbitrary commands.
How To Fix
Minimum fixed version
2.2.2
This is the first release that contains the fix.
npm install @tinacms/graphql@2.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the GraphQL API to authenticated users only, thereby preventing unauthenticated access that could exploit this vulnerability. Additionally, you can implement custom validation logic to sanitize the 'relativePath' input before processing it.
Conclusion
The Path Traversal vulnerability in @tinacms/graphql poses a significant risk to applications using this package. It is crucial to update to the patched version to mitigate the risk of unauthorized file access and modifications. Regular monitoring of dependencies using tools like Vulert can help maintain application security.
See every vulnerability recorded for @tinacms/graphql →
FAQ
A Path Traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized file access and modifications.
An attacker can overwrite critical files in your application, such as configuration files, which may lead to application downtime, data loss, or even arbitrary code execution.
If you are using @tinacms/graphql version 2.2.1 or earlier, your application is vulnerable. You can check for vulnerabilities using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for @tinacms/graphql.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
