Path Traversal in @tinacms/graphql

Vulnerability

Overview

CVE-2026-24125 is a path traversal vulnerability in TinaCMS, a headless content management system. Prior to version 2.1.2, the application’s GraphQL mutations accept relativePath and newRelativePath parameters to create, update, delete, or move content documents. The server builds the full file path by joining the collection’s base directory with the user-supplied relative path using path.join(). Because path.join() does not neutralize directory traversal sequences, an attacker can include ../ components to navigate outside the intended collection root directory [1][2].

Exploitation

An authenticated user with editor permissions can exploit this by crafting specific GraphQL requests. For example, the mutation createDocument(collection: "post", relativePath: "../../config/malicious.md", params: {...}) would attempt to create a file two directories above the collection root. Similar patterns exist for moving, renaming, and deleting documents, as well as creating folders. The updateDocument mutation accepts a new relativePath for renaming, and deleteDocument uses the path directly [2].

Impact and

Constraints

Successful exploitation allows an attacker to create files (subject to GraphQL schema validation), move or rename files, delete files, and read file contents via document retrieval mutations. However, several constraints limit the impact: created or modified content must conform to the collection’s GraphQL schema, so arbitrary content injection is prevented. Exploitation also requires authenticated access with CMS editor permissions. Additionally, in typical git-backed deployments, all file operations are tracked in git, providing an audit trail [2].

Mitigation

The vulnerability is fixed in TinaCMS version 2.1.2. Users are advised to upgrade to this version or later [1]. No workaround or other mitigation has been documented. The CVE is not currently listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.