CVE-2026-24125 - Vulnerability Analysis

Overview

TinaCMS < 2.1.2 contains a path traversal vulnerability caused by improper validation of relative file paths in GraphQL mutations, letting attackers modify files outside the intended directory, exploit requires crafted mutation requests.

Severity & Score

Impact

Attackers can modify or delete files outside the intended directory, potentially leading to data tampering or system compromise.

Mitigation

Update to version 2.1.2 or later.

References

• https://github.com/tinacms/tinacms/security/advisories/GHSA-2238-xc5r-v9hj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner