High severity · published Apr 1, 2026
CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The impact includes the ability to replace critical server configuration files and potentially execute arbitrary commands by sabotaging build script. This issue has been patched in version 2.2.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
tinacms · tinacms
< 2.2.2 · source: vendor
TI
Tinacms/graphql · Ssw
through 2.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33949
Vendor Advisory
https://github.com/tinacms/tinacms/security/advisories/GHSA-v9p7-gf3q-h779
More from tinacms
9.3
CVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
8.8
CVE-2026-63506
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
8.8
CVE-2026-34604
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions
8.8
CVE-2025-68278
tinacms vulnerable to arbitrary code execution
8.3
CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions