Description
TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory.
Recommendation
Update the @tinacms/graphql package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.1.1
- Patched version(s): 2.1.2
References
Could your website be exposed too?
SmartScanner can check your website for @tinacms/graphql has a Path Traversal issue and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files - CVE-2026-33949
- SillyTavern has a Path Traversal issue - CVE-2026-44650
- @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions - CVE-2026-34604
- liquidjs has a path traversal fallback vulnerability - CVE-2026-30952
You might also like:
See something that needs correcting? Let us knowUpdated March 12, 2026