Vulnerabilities

TI-2026-70295 CVE-2026-108261 · GHSA-x34j-47hf-4xg7

TinaCMS admin preview frames attacker-controlled origin

HIGH 75

Tina is a headless content management system.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00197 Published 2026-10-09 Fixed in 3.14.0, 2.5.14 CWE-346

TI-2026-70294 CVE-2026-108260 · GHSA-c42q-qvc3-j6vg

Stored XSS via unvalidated link URLs in @tinacms/web-components tina-markdown

HIGH 66

Tina is a headless content management system.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00254 Published 2026-10-09 Fixed in 3.14.0, 0.2.1 CWE-79

TI-2026-70293 CVE-2026-108259 · GHSA-pwhx-cvv3-qj5c

Code injection in Tina CLI via unescaped Git branch name

HIGH 71

Tina is a headless content management system.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00332 Published 2026-10-09 Fixed in 3.0.0 CWE-94

TI-2026-45239 CVE-2026-63506 · GHSA-g74q-6g2f-874x

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

HIGH 73

Tina is a headless content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00523 Published 2026-09-16 Fixed in 1.1.4, 15.0.1 CWE-639

TI-2026-45062 CVE-2026-63123 · GHSA-rgr9-r7mj-mf6x

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

MEDIUM 62

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00264 Published 2026-08-19 Fixed in 2.5.2 CWE-352

TI-2026-42776 CVE-2026-59992 · GHSA-8mq9-5fw2-5rm4

Authorization bypass in tinacms

MEDIUM 58

Tina is a headless content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0038 Published 2026-08-19 Fixed in 23.0.4, 14.0.4 +1 CWE-639

TI-2026-40183 CVE-2026-55660 · GHSA-g5qx-h5f3-mp2f

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

LOW 35

Tina is a headless content management system.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00279 Published 2026-07-01 Fixed in 3.9.3, 2.5.6 CWE-346

TI-2026-39005 CVE-2026-54074 · GHSA-4936-9hrh-qqpw

Code injection in tinacms

HIGH 69

Tina is a headless content management system.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00251 Published 2026-07-01 Fixed in 2.4.3 CWE-94

TI-2026-40184 CVE-2026-55661 · GHSA-2vcc-5v34-9jc8

TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

LOW 22

Tina is a headless content management system.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00405 Published 2026-07-01 Fixed in 3.9.3, 2.1.7 CWE-79

TI-2026-26850 CVE-2026-34603 · GHSA-g87c-r2jp-293w

@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

HIGH 71

Tina is a headless content management system.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00424 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-26851 CVE-2026-34604 · GHSA-g9c2-gf25-3x67

@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

HIGH 73

Tina is a headless content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00379 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-26299 CVE-2026-33949 · GHSA-v9p7-gf3q-h779

@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

HIGH 68

Tina is a headless content management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00394 Published 2026-04-01 Fixed in 2.2.2 CWE-22

TI-2026-23211 CVE-2026-29066 · GHSA-m48g-4wr2-j2h6

Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

MEDIUM 61

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.0111 Published 2026-03-12 Fixed in 2.1.8 CWE-200

TI-2026-22986 CVE-2026-28791 · GHSA-5hxf-c7j4-279c

Path Traversal in Media Upload Handle in Tina

HIGH 68

Tina is a headless content management system.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00377 Published 2026-03-12 Fixed in 2.1.7 CWE-22

TI-2026-22988 CVE-2026-28793 · GHSA-2f24-mg4x-534q

Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS

HIGH 72

Tina is a headless content management system.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00237 Published 2026-03-12 Fixed in 2.1.8 CWE-22

TI-2026-22987 CVE-2026-28792 · GHSA-8pw3-9m7f-q734

Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

HIGH 76

Tina is a headless content management system.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00637 Published 2026-03-12 Fixed in 2.1.8 CWE-22

TI-2026-19443 CVE-2026-24125 · GHSA-2238-xc5r-v9hj

Path Traversal in @tinacms/graphql

MEDIUM 61

Tina is a headless content management system.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00495 Published 2026-03-12 Fixed in 2.1.2 CWE-22

TI-2025-41854 CVE-2025-68278 · GHSA-529f-9qwm-9628

tinacms vulnerable to arbitrary code execution

HIGH 67

Tina is a headless content management system.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00479 Published 2025-12-18 Fixed in 3.1.1, 2.0.4 +1 CWE-94

TI-2024-30440 CVE-2024-45391 · GHSA-4qrm-9h4r-v2fx

Tina search token leak via lock file in TinaCMS

LOW 33

Tina is an open-source content management system (CMS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00306 Published 2024-09-03 Fixed in 1.6.2 CWE-200

TI-2023-10626 CVE-2023-25164 · GHSA-pc2q-jcxq-rjrr

Sensitive Information leak via Script File in TinaCMS

MEDIUM 44

Tinacms is a Git-backed headless content management system with support for visual editing.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00675 Published 2023-02-08 Fixed in 1.0.9 CWE-200

Vulnerabilities

Filters