CVE-2026-24125: TinaCMS Path Traversal Vulnerability

CVE-2026-24125 Overview

CVE-2026-24125 is a Path Traversal vulnerability affecting TinaCMS, a headless content management system. Prior to version 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory. Because path.join() does not prevent directory traversal, paths containing ../ sequences can escape the intended directory boundary.

Critical Impact
Authenticated attackers can leverage this path traversal vulnerability to read, modify, or delete files outside the intended content directory, potentially compromising system integrity and data confidentiality.

Affected Products

TinaCMS versions prior to 2.1.2

Discovery Timeline

2026-03-12 - CVE CVE-2026-24125 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-24125

Vulnerability Analysis

This vulnerability falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The core issue stems from insufficient validation of user-controlled file paths before they are processed by the file system operations.

TinaCMS exposes GraphQL mutations that accept relative file paths as parameters. When users invoke these mutations to create, update, or delete content documents, the CMS combines the user-supplied relativePath or newRelativePath with the configured collection path. The vulnerability arises because the application uses Node.js's path.join() function to concatenate these paths without subsequently verifying that the resulting absolute path remains within the intended collection root directory.

The path.join() function normalizes path segments but does not inherently prevent directory traversal. When an attacker supplies a path containing ../ sequences, the function processes these as legitimate path components, allowing the resulting path to escape the collection boundary and access files elsewhere on the filesystem.

Root Cause

The root cause is the absence of path canonicalization and boundary validation after combining user-supplied relative paths with the collection root. The application trusts that the relativePath parameter will resolve to a location within the expected directory structure, but fails to enforce this constraint programmatically. This allows malicious input to traverse the directory hierarchy and access unauthorized locations.

Attack Vector

An authenticated attacker with access to the TinaCMS GraphQL API can exploit this vulnerability by crafting malicious GraphQL mutations containing path traversal sequences. The attack is network-accessible and requires low-privileged authentication to the CMS.

The attacker would construct a GraphQL mutation targeting content creation, modification, or deletion endpoints, substituting the legitimate relativePath value with a path containing ../ sequences designed to escape the collection directory. For example, targeting sensitive configuration files or application source code outside the content directory could allow information disclosure or system compromise.

Since the vulnerability affects create, update, and delete operations, successful exploitation could result in:

Reading sensitive files outside the content directory
Overwriting critical system or application files
Deleting important data or configuration files

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-24125

Indicators of Compromise

GraphQL mutation requests containing ../ or encoded path traversal sequences in relativePath or newRelativePath parameters
Unexpected file access or modification events outside the designated TinaCMS content directories
Error logs indicating file operations on paths outside collection boundaries
Unusual patterns in GraphQL API access logs showing repeated mutation attempts with varying path parameters

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in GraphQL request bodies
Monitor GraphQL mutation logs for requests containing directory traversal sequences such as ../, ..%2f, or ..%5c
Deploy runtime application self-protection (RASP) solutions to detect path traversal attempts at the application layer
Conduct regular code audits of file path handling logic in custom TinaCMS implementations

Monitoring Recommendations

Enable detailed logging for all TinaCMS GraphQL mutations involving file operations
Set up alerts for file access attempts outside configured content directories
Monitor system integrity of critical files that could be targeted through path traversal
Review access logs for authenticated users performing unusual volumes of content operations

How to Mitigate CVE-2026-24125

Immediate Actions Required

Upgrade TinaCMS to version 2.1.2 or later immediately
Audit recent GraphQL mutation logs for suspicious path traversal patterns
Review file system permissions to ensure the TinaCMS process has minimal required access
Implement network-level controls to restrict access to the GraphQL API to trusted sources only

Patch Information

TinaCMS has addressed this vulnerability in version 2.1.2. The fix includes proper validation to ensure that resolved file paths remain within the intended collection root directory. Organizations running affected versions should upgrade immediately.

For more information about the security fix, refer to the GitHub Security Advisory.

Workarounds

Implement a reverse proxy or WAF rule to sanitize GraphQL requests and reject those containing path traversal sequences
Restrict filesystem permissions for the TinaCMS application to limit the scope of potential exploitation
Implement additional server-side validation of file paths before processing GraphQL mutations
Consider running TinaCMS in a containerized environment with restricted filesystem access to limit the impact of successful exploitation