Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory. Because path.join() does not prevent directory traversal, paths containing ../ sequences can escape the intended directory boundary. This vulnerability is fixed in 2.1.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24125 Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (relative… https://www.cve.org/CVERecord?id=CVE-2026-24125
Post summary
The text announces a CVE-2026-24125 vulnerability in TinaCMS, noting that pre‑2.1.2 releases permit CRUD operations on content documents via relative file paths.
CVE-2026-24125 Path Traversal Vulnerability in TinaCMS GraphQL Mutations Prior to 2.1.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24125
Post summary
A path traversal flaw was identified in TinaCMS GraphQL mutations before version 2.1.2, and updating to 2.1.2 provides a fix; no PoC, exploit, or active exploitation evidence was reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ssw | tinacms\/graphql | - | node.js | - |