CVE-2026-24125: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24125 is a path traversal vulnerability (CWE-22) in the @tinacms/graphql package of TinaCMS, a headless content management system. It affects all versions up to and including 2.1.1 of the npm package @tinacms/graphql. The vulnerability was published on March 12, 2026, and fixed in version 2.1.2. It carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, TinaCMS Advisory).

The root cause is improper path validation (CWE-22) in TinaCMS's GraphQL mutation handlers. When users supply relativePath or newRelativePath arguments to GraphQL mutations (createDocument, updateDocument, deleteDocument, createFolder), these values are concatenated with the collection's root directory using Node.js's path.join(). Because path.join() resolves ../ sequences without enforcing a boundary, an attacker can supply traversal sequences (e.g., ../../config/malicious.md) to escape the intended collection directory. The attack is network-accessible and requires only low privileges (authenticated CMS editor access), with no user interaction needed (TinaCMS Advisory, GitHub Advisory).

An authenticated attacker with CMS editor permissions can create, move, rename, or delete files outside the intended collection root directory, and read file contents via document retrieval mutations. While written file content is constrained by GraphQL schema validation (preventing fully arbitrary writes), an attacker could still overwrite or delete sensitive configuration files, potentially leading to service disruption or, under certain conditions, code execution. All file operations in typical deployments are tracked in git, limiting the risk of silent tampering, but the integrity and availability of the application and its underlying filesystem are at risk (TinaCMS Advisory).

A proof-of-concept (PoC) is publicly available in the official security advisory, including concrete GraphQL mutation payloads and a Node.js command demonstrating the path traversal behavior (TinaCMS Advisory). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.093% (26th percentile), indicating a low near-term exploitation probability (GitHub Advisory). Exploitation requires authenticated access, which limits the attacker pool.

1. Reconnaissance: Identify a TinaCMS deployment running @tinacms/graphql version ≤ 2.1.1 with an exposed GraphQL endpoint (e.g., /api/tina/gql).
2. Authenticate: Obtain valid CMS editor credentials (e.g., via phishing, credential stuffing, or insider access) to gain access to the GraphQL mutation API.
3. Craft traversal payload: Construct a GraphQL mutation using ../ sequences in the relativePath argument to target a file outside the collection root. Example for file creation:

createDocument(
  collection: "post"
  relativePath: "../../config/malicious.md"
  params: { post: { title: "malicious" } }
)

4. Execute mutation: Submit the crafted GraphQL mutation to the TinaCMS endpoint. The server resolves the path using path.join('content/posts', '../../config/malicious.md'), resulting in config/malicious.md — outside the collection boundary.
5. Achieve objective: Depending on the goal, create schema-conformant files in sensitive directories, delete critical configuration files, move/rename existing files to attacker-controlled paths, or read file contents via document retrieval mutations (TinaCMS Advisory).

• Network: Unusual GraphQL mutation requests to the TinaCMS API endpoint containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in relativePath or newRelativePath parameters.
• Logs: Application or web server logs showing GraphQL mutations (createDocument, updateDocument, deleteDocument, createFolder) with path values containing .. sequences; unexpected file paths referenced in mutation arguments outside the expected collection directories.
• File System: Unexpected files or directories created, modified, or deleted outside the configured TinaCMS collection root (e.g., in parent directories of content/); schema-conformant markdown files appearing in configuration or application directories.
• Version Control (Git): Unexpected commits or staged changes in git history showing file additions, deletions, or renames outside collection directories, attributed to CMS editor accounts (TinaCMS Advisory).

Upgrade @tinacms/graphql to version 2.1.2 or later, which resolves the path traversal issue by validating that resolved file paths remain within the collection root directory (TinaCMS Advisory, GitHub Advisory). As interim mitigations, restrict CMS editor access to only trusted users, and consider implementing server-side input validation to reject any relativePath values containing ../ sequences. Monitoring git history for unexpected file changes outside collection directories can help detect exploitation attempts.