Tinacms Graphql vulnerabilities

CVE-2026-34604 [HIGH] CWE-22 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions ## Summary `@tinacms/graphql` uses string-based path containment checks in `FilesystemBridge`: - `path.resolve(path.join(baseDir, filepath))` - `startsWith(resolvedBase + path.sep)` That blocks plain `../` traversal, but it does not resolve symlink or junction targets. If a

CVE-2026-34603 [HIGH] CWE-22 @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions ## Summary `@tinacms/cli` recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the media root, Tina accepts a path like `pivot/written-f

CVE-2026-33949 [HIGH] CWE-22 @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files ### Summary A Path Traversal vulnerability in `@tinacms/graphql` allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the `relativePath` parameter in GraphQL mutations. The impact includes the ability to replace critical server configurati

CVE-2026-24125 [MEDIUM] CWE-22 CVE-2026-24125: Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path rema

CVE-2025-68278 [HIGH] CWE-94 tinacms is vulnerable to arbitrary code execution tinacms is vulnerable to arbitrary code execution ### Summary ```tinacms``` uses the ```gray-matter``` package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. ### Details The ```gray-matter``` package executes by default the code in the markdown file's front matter. ```tinacms``` does not change this behavior when proces