CVE-2026-24125 Path Traversal in @tinacms/graphql

Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths relativePath, newRelativePath via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using...

CVE-2026-24125 Path Traversal in @tinacms/graphql

Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths relativePath, newRelativePath via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using...

CVE-2026-24125: Improper Limitation of a Pathname to a Restricted Directory

Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths relativePath, newRelativePath via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using...

CVE-2026-28792: Improper Limitation of a Pathname to a Restricted Directory

Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration Access-Control-Allow-Origin: with the path traversal vulnerability previously reported to enable a browser-based drive-by attack. A remote attacker can enumerate the...

CVE-2026-28793: Improper Limitation of a Pathname to a Restricted Directory

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, th...

CVE-2026-29066: Files or Directories Accessible to External Parties

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the...

TinaCMS 安全漏洞

TinaCMS is an open-source headless CMS for Markdown, MDX, and JSON developed by Tina. Versions of TinaCMS prior to 2.1.8 contained a security vulnerability. This vulnerability stemmed from the TinaCMS CLI development server’s configuration using Vite, which disabled the built-in file system acces...

TinaCMS 路径遍历漏洞

TinaCMS is an open-source headless CMS developed by Tina for Markdown, MDX, and JSON formats. Versions of TinaCMS prior to 2.1.7 had a path traversal vulnerability. This vulnerability stemmed from issues with the media upload processing mechanism used by the TinaCMS development server, allowing f...

CVE-2023-25164

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...

CVE-2025-68278

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cl...

@tinacms/app (>=2.3.12, <=2.3.15), @tinacms/cli (>=2.0.0, <=2.0.3) +1 more potentially affected by CVE-2025-68278 via tinacms (>=3.0.0, <=3.1.0)

tinacms NPM version =3.0.0, =2.3.12, =2.0.0, =0.1.12, =0.1.15 Source cves: CVE-2025-68278 Source advisory: SNYK:JS-TINACMS-14535449...

@tinacms/app (>=2.3.12, <=2.3.15), @tinacms/cli (>=2.0.0, <=2.0.3) +1 more potentially affected by CVE-2025-68278 via tinacms (>=3.0.0, <=3.1.0)

tinacms NPM version =3.0.0, =2.3.12, =2.0.0, =0.1.12, =0.1.15 Source cves: CVE-2025-68278 Source advisory: OSV:GHSA-529F-9QWM-9628...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.15), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.0.3) +4 more potentially affected by CVE-2025-68278 via @tinacms/graphql (>=2.0.0, <=2.0.2)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.1.0 Source cves: CVE-2025-68278 Source advisory: SNYK:JS-TINACMSGRAPHQL-14535448...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.15), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.0.3) +4 more potentially affected by CVE-2025-68278 via @tinacms/graphql (>=2.0.0, <=2.0.2)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.1.0 Source cves: CVE-2025-68278 Source advisory: OSV:GHSA-529F-9QWM-9628...

GHSA-529F-9QWM-9628 tinacms is vulnerable to arbitrary code execution

Summary tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. Details The gray-matter package executes by default the code in the markdown file's front matter. tinacms...

Arbitrary Code Injection

Overview tinacms is a headless content management system with support for Markdown, MDX, JSON, YAML, and more. Affected versions of this package are vulnerable to Arbitrary Code Injection via the improper use of gray-matter package. An attacker can execute arbitrary code on the server by submitti...

tinacms is vulnerable to arbitrary code execution

Summary tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. Details The gray-matter package executes by default the code in the markdown file's front matter. tinacms...

CVE-2025-68278

CVE-2025-68278 affects tinacms prior to 3.1.1, where insecure use of the gray-matter package allows attackers who can control markdown front matter (e.g., blog posts) to execute arbitrary code. The issue spans tinacms, @tinacms/cli (v2.0.4), and @tinacms/graphql (v2.0.3). A fix is available in ti...

CVE-2025-68278 tinacms vulnerable to arbitrary code execution

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cl...

CVE-2025-68278 tinacms vulnerable to arbitrary code execution

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cl...