@tinacms/graphql has a Path Traversal issue

Description

TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory.

Recommendation

Update the @tinacms/graphql package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.1.1
• Patched version(s): 2.1.2

References

• GHSA-2238-xc5r-v9hj
• CVE-2026-24125
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files - CVE-2026-33949
• SillyTavern has a Path Traversal issue - CVE-2026-44650
• @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions - CVE-2026-34604
• liquidjs has a path traversal fallback vulnerability - CVE-2026-30952

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@tinacms/graphql