CVE-2026-24125: @tinacms/graphql Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2238-xc5r-v9hj",
  "modified" : "2026-03-12T19:13:56Z",
  "published" : "2026-03-12T17:50:28Z",
  "aliases" : [ "CVE-2026-24125" ],
  "summary" : "@tinacms/graphql has a Path Traversal issue",
  "details" : "### Description\n\nTinaCMS allows users to create, update, and delete content documents using relative file paths (`relativePath`, `newRelativePath`) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using `path.join()` without validating that the resolved path remains within the collection root directory.\n\nBecause `path.join()` does not prevent directory traversal, paths containing `../` sequences can escape the intended directory boundary.\n\n### Attack Vectors\n\n1. **File Creation**: Create files outside the collection directory\n   ```graphql\n   createDocument(\n     collection: \"post\"\n     relativePath: \"../../config/malicious.md\"\n     params: { post: { title: \"malicious\" } }\n   )\n   ```\n\n2. **File Move/Rename**: Move existing files outside the collection\n   ```graphql\n   updateDocument(\n     collection: \"post\"\n     relativePath: \"existing.md\"\n     params: { relativePath: \"../../stolen.md\" }\n   )\n   ```\n\n3. **File Deletion**: Delete files outside the collection\n   ```graphql\n   deleteDocument(\n     collection: \"post\"\n     relativePath: \"../../important-config.md\"\n   )\n   ```\n\n4. **Folder Creation**: Create folders outside the collection\n   ```graphql\n   createFolder(\n     collection: \"post\"\n     relativePath: \"../../malicious-folder\"\n   )\n   ```\n\n## Impact\n\nAn authenticated user with document mutation permissions can:\n\n- **Create content files** outside collection boundaries (subject to schema validation)\n- **Move or rename files** outside collection boundaries\n- **Delete content files** outside collection boundaries\n- **Read file contents** via document retrieval mutations\n\n## Mitigating Factors\n\nSeveral constraints limit the practical impact of this vulnerability:\n\n1. **Schema Validation**: Created/updated content must conform to the collection's GraphQL schema. Attackers cannot write arbitrary file content—the `params` argument is validated against the generated mutation types (e.g., `PostMutation`).\n\n2. **Authentication Required**: Exploitation requires authenticated access with CMS editor permissions. Anonymous users cannot access GraphQL mutations.\n\n3. **Git Tracking**: In typical deployments, all file operations are tracked in git (either via GitHub API for Tina Cloud/self-hosted with GitProvider, or local filesystem changes). Malicious changes are visible in version control and can be reverted.\n\n### What This Vulnerability Does NOT Allow\n\n- Writing arbitrary file content (content is schema-validated)\n- Silent/untracked file modifications (changes appear in git)\n- Unauthenticated access\n\n## Proof of Concept\n\nSee `packages/@tinacms/graphql/tests/path-traversal-security/index.test.ts` for automated tests demonstrating the vulnerability.\n\nManual reproduction:\n```bash\nnode -e \"\nconst path = require('path');\n\nconst collectionPath = 'content/posts';\nconst maliciousRelativePath = '../../OUTSIDE/poc.md';\n\nconst realPath = path.join(collectionPath, maliciousRelativePath);\nconsole.log('Resolved path:', realPath);\n// Output: OUTSIDE/poc.md (escaped content/posts)\n\"\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@tinacms/graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.1.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.1.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/tinacms/tinacms/security/advisories/GHSA-2238-xc5r-v9hj"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-24125"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/tinacms/tinacms"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-12T17:50:28Z",
    "nvd_published_at" : "2026-03-12T17:16:39Z"
  }
}