CVE-2026-33949 in CMS
要約 (英語)
Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The impact includes the ability to replace critical server configuration files and potentially execute arbitrary commands by sabotaging build script. This issue has been patched in version 2.2.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
責任者
GitHub_M
予約する
2026年03月24日
公開
2026年04月01日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 354712 | Tina CMS GraphQL Mutation ディレクトリトラバーサル | 22 | 未定義 | 公式な修正 | CVE-2026-33949 |