tinacms

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

tinacms records in CISA KEV

No tinacms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Tinacms/cli 8 records HIGH Tinacms/graphql 4 records HIGH Tinacms 1 record HIGH

Records

20 records

TI-2026-22987 CVE-2026-28792 · GHSA-8pw3-9m7f-q734

Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

HIGH 76

Tina is a headless content management system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00637 Published 2026-03-12 Fixed in 2.1.8 CWE-22

TI-2026-70295 CVE-2026-108261 · GHSA-x34j-47hf-4xg7

TinaCMS admin preview frames attacker-controlled origin

HIGH 75

Tina is a headless content management system.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00197 Published 2026-10-09 Fixed in 3.14.0, 2.5.14 CWE-346

TI-2026-45239 CVE-2026-63506 · GHSA-g74q-6g2f-874x

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

HIGH 73

Tina is a headless content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00523 Published 2026-09-16 Fixed in 1.1.4, 15.0.1 CWE-639

TI-2026-26851 CVE-2026-34604 · GHSA-g9c2-gf25-3x67

@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

HIGH 73

Tina is a headless content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00379 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-22988 CVE-2026-28793 · GHSA-2f24-mg4x-534q

Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS

HIGH 72

Tina is a headless content management system.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00237 Published 2026-03-12 Fixed in 2.1.8 CWE-22

TI-2026-70293 CVE-2026-108259 · GHSA-pwhx-cvv3-qj5c

Code injection in Tina CLI via unescaped Git branch name

HIGH 71

Tina is a headless content management system.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00332 Published 2026-10-09 Fixed in 3.0.0 CWE-94

TI-2026-26850 CVE-2026-34603 · GHSA-g87c-r2jp-293w

@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

HIGH 71

Tina is a headless content management system.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00424 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-39005 CVE-2026-54074 · GHSA-4936-9hrh-qqpw

Code injection in tinacms

HIGH 69

Tina is a headless content management system.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00251 Published 2026-07-01 Fixed in 2.4.3 CWE-94

TI-2026-26299 CVE-2026-33949 · GHSA-v9p7-gf3q-h779

@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

HIGH 68

Tina is a headless content management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00394 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-22986 CVE-2026-28791 · GHSA-5hxf-c7j4-279c

Path Traversal in Media Upload Handle in Tina

HIGH 68

Tina is a headless content management system.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00377 Published 2026-03-12 Fixed in 2.1.7 CWE-22

TI-2025-41854 CVE-2025-68278 · GHSA-529f-9qwm-9628

tinacms vulnerable to arbitrary code execution

HIGH 67

Tina is a headless content management system.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00479 Published 2025-12-18 Fixed in 3.1.1, 2.0.4 +1 CWE-94

TI-2026-70294 CVE-2026-108260 · GHSA-c42q-qvc3-j6vg

Stored XSS via unvalidated link URLs in @tinacms/web-components tina-markdown

HIGH 66

Tina is a headless content management system.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00254 Published 2026-10-09 Fixed in 3.14.0, 0.2.1 CWE-79

TI-2026-45062 CVE-2026-63123 · GHSA-rgr9-r7mj-mf6x

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

MEDIUM 62

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00264 Published 2026-08-19 Fixed in 2.5.2 CWE-352

TI-2026-23211 CVE-2026-29066 · GHSA-m48g-4wr2-j2h6

Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

MEDIUM 61

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.0111 Published 2026-03-12 Fixed in 2.1.8 CWE-200

TI-2026-19443 CVE-2026-24125 · GHSA-2238-xc5r-v9hj

Path Traversal in @tinacms/graphql

MEDIUM 61

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00495 Published 2026-03-12 Fixed in 2.1.2 CWE-22

TI-2026-42776 CVE-2026-59992 · GHSA-8mq9-5fw2-5rm4

Authorization bypass in tinacms

MEDIUM 58

Tina is a headless content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0038 Published 2026-08-19 Fixed in 23.0.4, 14.0.4 +1 CWE-639

TI-2023-10626 CVE-2023-25164 · GHSA-pc2q-jcxq-rjrr

Sensitive Information leak via Script File in TinaCMS

MEDIUM 44

Tinacms is a Git-backed headless content management system with support for visual editing.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00675 Published 2023-02-08 Fixed in 1.0.9 CWE-200

TI-2026-40183 CVE-2026-55660 · GHSA-g5qx-h5f3-mp2f

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

LOW 35

Tina is a headless content management system.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00279 Published 2026-07-01 Fixed in 3.9.3, 2.5.6 CWE-346

TI-2024-30440 CVE-2024-45391 · GHSA-4qrm-9h4r-v2fx

Tina search token leak via lock file in TinaCMS

LOW 33

Tina is an open-source content management system (CMS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00306 Published 2024-09-03 Fixed in 1.6.2 CWE-200

TI-2026-40184 CVE-2026-55661 · GHSA-2vcc-5v34-9jc8

TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

LOW 22

Tina is a headless content management system.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00405 Published 2026-07-01 Fixed in 3.9.3, 2.1.7 CWE-79

Open these records in search →

Critical	2
High	13
Medium	5
Low	0
No CVSS	0