Vulnerabilities

TI-2026-26851 CVE-2026-34604 · GHSA-g9c2-gf25-3x67

@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

HIGH 73

Tina is a headless content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00379 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-26299 CVE-2026-33949 · GHSA-v9p7-gf3q-h779

HIGH 68

Tina is a headless content management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00394 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-19443 CVE-2026-24125 · GHSA-2238-xc5r-v9hj

MEDIUM 61

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00495 Published 2026-03-12 Fixed in 2.1.2 CWE-22

TI-2025-41854 CVE-2025-68278 · GHSA-529f-9qwm-9628

HIGH 67

Tina is a headless content management system.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00479 Published 2025-12-18 Fixed in 3.1.1, 2.0.4 +1 CWE-94