tinacms

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

tinacms records in CISA KEV

No tinacms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Tinacms/cli 8 records HIGH Tinacms/graphql 4 records HIGH Tinacms 1 record HIGH

Records

8 records in Tinacms/cli · all components

TI-2026-22987 CVE-2026-28792 · GHSA-8pw3-9m7f-q734

Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

HIGH 76

Tina is a headless content management system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00637 Published 2026-03-12 Fixed in 2.1.8 CWE-22

TI-2026-22988 CVE-2026-28793 · GHSA-2f24-mg4x-534q

Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS

HIGH 72

Tina is a headless content management system.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00237 Published 2026-03-12 Fixed in 2.1.8 CWE-22

TI-2026-26850 CVE-2026-34603 · GHSA-g87c-r2jp-293w

@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

HIGH 71

Tina is a headless content management system.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00424 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-22986 CVE-2026-28791 · GHSA-5hxf-c7j4-279c

Path Traversal in Media Upload Handle in Tina

HIGH 68

Tina is a headless content management system.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00377 Published 2026-03-12 Fixed in 2.1.7 CWE-22

TI-2025-41854 CVE-2025-68278 · GHSA-529f-9qwm-9628

tinacms vulnerable to arbitrary code execution

HIGH 67

Tina is a headless content management system.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00479 Published 2025-12-18 Fixed in 3.1.1, 2.0.4 +1 CWE-94

TI-2026-23211 CVE-2026-29066 · GHSA-m48g-4wr2-j2h6

Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

MEDIUM 61

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.0111 Published 2026-03-12 Fixed in 2.1.8 CWE-200

TI-2023-10626 CVE-2023-25164 · GHSA-pc2q-jcxq-rjrr

Sensitive Information leak via Script File in TinaCMS

MEDIUM 44

Tinacms is a Git-backed headless content management system with support for visual editing.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00675 Published 2023-02-08 Fixed in 1.0.9 CWE-200

TI-2024-30440 CVE-2024-45391 · GHSA-4qrm-9h4r-v2fx

Tina search token leak via lock file in TinaCMS

LOW 33

Tina is an open-source content management system (CMS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00306 Published 2024-09-03 Fixed in 1.6.2 CWE-200

Open these records in search →