Vulnerabilities

TI-2026-26850 CVE-2026-34603 · GHSA-g87c-r2jp-293w

@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

HIGH 71

Tina is a headless content management system.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00424 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-23211 CVE-2026-29066 · GHSA-m48g-4wr2-j2h6

MEDIUM 61

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.0111 Published 2026-03-12 Fixed in 2.1.8 CWE-200

TI-2026-22986 CVE-2026-28791 · GHSA-5hxf-c7j4-279c

HIGH 68

Tina is a headless content management system.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00377 Published 2026-03-12 Fixed in 2.1.7 CWE-22

TI-2026-22988 CVE-2026-28793 · GHSA-2f24-mg4x-534q

HIGH 72

Tina is a headless content management system.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00237 Published 2026-03-12 Fixed in 2.1.8 CWE-22

TI-2026-22987 CVE-2026-28792 · GHSA-8pw3-9m7f-q734

HIGH 76

Tina is a headless content management system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00637 Published 2026-03-12 Fixed in 2.1.8 CWE-22

TI-2025-41854 CVE-2025-68278 · GHSA-529f-9qwm-9628

HIGH 67

Tina is a headless content management system.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00479 Published 2025-12-18 Fixed in 3.1.1, 2.0.4 +1 CWE-94

TI-2024-30440 CVE-2024-45391 · GHSA-4qrm-9h4r-v2fx

LOW 33

Tina is an open-source content management system (CMS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00306 Published 2024-09-03 Fixed in 1.6.2 CWE-200

TI-2023-10626 CVE-2023-25164 · GHSA-pc2q-jcxq-rjrr

MEDIUM 44

Tinacms is a Git-backed headless content management system with support for visual editing.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00675 Published 2023-02-08 Fixed in 1.0.9 CWE-200