CVE-2026-33949

Katalog CVE

CVSS 8.1 · High EPSS 0,63%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada ssw tinacms/graphql. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The impact includes the ability to replace critical server configuration files and potentially execute arbitrary commands by sabotaging build script. This issue has been patched in version 2.2.2.

Rincian

Terbit di NVD

1 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 49,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tinacms/tinacms/security/advisories/GHSA-v9p7-gf3q-h779 advisory vendor