CVE-2026-33949
Last modified
CVE-2026-33949 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The impact includes the ability to replace critical server configuration files and potentially execute arbitrary commands by sabotaging build script. This issue has been patched in version 2.2.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ssw | Tinacms\/Graphql | <= 2.2.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33949?
How severe is CVE-2026-33949?
How do I fix CVE-2026-33949?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33942Saloon is a PHP library that gives users tools to build API …9.8
- CVE-2026-33943Happy DOM is a JavaScript implementation of a web browser wi…9.8
- CVE-2026-33945Incus is a system container and virtual machine manager. Inc…9.6
- CVE-2026-33946MCP Ruby SDK is the official Ruby SDK for Model Context Prot…5.9
- CVE-2026-33947jq is a command-line JSON processor. In versions 1.8.1 and b…5.5
- CVE-2026-33948jq is a command-line JSON processor. Commits before 6374ae0b…5.3
- CVE-2026-3395A flaw has been found in MaxSite CMS up to 109.1. This impac…9.8
- CVE-2026-33950Signal K Server is a server application that runs on a centr…9.4
- CVE-2026-33951Signal K Server is a server application that runs on a centr…7.5
- CVE-2026-33952FreeRDP is a free implementation of the Remote Desktop Proto…6.5
- CVE-2026-33953LinkAce is a self-hosted archive to collect website links. V…8.5
- CVE-2026-33954LinkAce is a self-hosted archive to collect website links. I…6.5
Are you affected by CVE-2026-33949?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST