CVE-2026-24125

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24125", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.473Z", "datePublished": "2026-03-12T16:31:56.860Z", "dateUpdated": "2026-03-12T17:55:19.636Z"}, "containers": {"cna": {"title": "Path Traversal in @tinacms/graphql", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2238-xc5r-v9hj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2238-xc5r-v9hj"}], "affected": [{"vendor": "@tinacms", "product": "graphql", "versions": [{"version": "< 2.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T16:31:56.860Z"}, "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory. Because path.join() does not prevent directory traversal, paths containing ../ sequences can escape the intended directory boundary. This vulnerability is fixed in 2.1.2."}], "source": {"advisory": "GHSA-2238-xc5r-v9hj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T17:54:30.695250Z", "id": "CVE-2026-24125", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T17:55:19.636Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24125", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T17:54:30.695250Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T17:55:12.389Z"}}], "cna": {"title": "Path Traversal in @tinacms/graphql", "source": {"advisory": "GHSA-2238-xc5r-v9hj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "@tinacms", "product": "graphql", "versions": [{"status": "affected", "version": "< 2.1.2"}]}], "references": [{"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2238-xc5r-v9hj", "name": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2238-xc5r-v9hj", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory. Because path.join() does not prevent directory traversal, paths containing ../ sequences can escape the intended directory boundary. This vulnerability is fixed in 2.1.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T16:31:56.860Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24125", "state": "PUBLISHED", "dateUpdated": "2026-03-12T17:55:19.636Z", "dateReserved": "2026-01-21T18:38:22.473Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T16:31:56.860Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "graphql", "vendor": "@tinacms", "versions": [{"status": "affected", "version": "< 2.1.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ssw:tinacms\\/graphql:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "5CA145FF-AF13-4D53-8197-C2195D6B2462", "versionEndExcluding": "2.1.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory. Because path.join() does not prevent directory traversal, paths containing ../ sequences can escape the intended directory boundary. This vulnerability is fixed in 2.1.2."}, {"lang": "es", "value": "Tina es un sistema de gesti\u00f3n de contenido sin interfaz. Antes de la versi\u00f3n 2.1.2, TinaCMS permite a los usuarios crear, actualizar y eliminar documentos de contenido utilizando rutas de archivo relativas (relativePath, newRelativePath) a trav\u00e9s de mutaciones GraphQL. Bajo ciertas condiciones, estas rutas se combinan con la ruta de la colecci\u00f3n utilizando path.join() sin validar que la ruta resuelta permanezca dentro del directorio ra\u00edz de la colecci\u00f3n. Dado que path.join() no evita el salto de directorio, las rutas que contienen secuencias ../ pueden escapar del l\u00edmite de directorio previsto. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.1.2."}], "id": "CVE-2026-24125", "lastModified": "2026-06-17T10:22:40.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24125", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T17:54:30.695250Z", "version": "2.0.3"}}]}, "published": "2026-03-12T17:16:39.233", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2238-xc5r-v9hj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "graphql", "source": "cna", "vendor": "@tinacms"}, "product": "tinacms", "vendor": "tina"}], "analysis": {"en": {"generated_at": "2026-03-18T14:37:16.207122+00:00", "value": {"mitigation_remediation": ["Upgrade @tinacms/graphql to version 2.1.2 or later."], "summary": {"action": "Apply Patch", "impact": "Path Traversal leading to unauthorized file access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects @tinacms:graphql packages in all releases before version 2.1.2. Users running any of these earlier releases are potentially vulnerable. The CPE for affected products is cpe:2.3:a:ssw:tinacms/graphql:*:*:*:*:*:node.js:*:*.", "description_and_impact": "TinaCMS allows the creation, updating, and deleting of content documents via GraphQL mutations that accept relative file paths. The system combines these paths with the collection root using path.join() without validating that the resolved path remains inside the intended directory. Because path.join() does not prevent directory traversal, an attacker can supply paths containing '../' sequences to escape the collection boundary. This results in the ability to read or write files outside the intended content area, potentially exposing confidential data or modifying system files. The weakness is identified as CWE-22: Path Traversal.", "risk_and_exploitability": "The CVSS score of 6.3 indicates a medium severity vulnerability, and the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to execute GraphQL mutations, implying that an attacker must either be an authenticated user with builder or editor permissions, or that the GraphQL endpoint is otherwise accessible without authentication. The impact could be significant if the attacker gains access to critical files outside the collection directory. Given the moderate CVSS score and low EPSS, the risk is medium, but the potential harm warrants prompt remediation."}}}}, "created": "2026-03-13T09:51:08.768513+00:00", "updated": "2026-03-20T15:48:59.873535+00:00", "vendors": ["tina", "tina$PRODUCT$tinacms"]}