GHSA-5hxf-c7j4-279c
High · 7.4CVSS
7.4
EPSS
—
Published
Mar 12, 2026
CISA due date
—
The record
Tina: Path Traversal in Media Upload Handle
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tinacms | 0 | 2.1.7 |
Related vulnerabilities
- CVE-2026-28791 Tina is a headless content management system. Same vulnerability
- CVE-2026-55661 Tina is a headless content management system. Also affects tinacms
- GHSA-g5qx-h5f3-mp2f TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable… Also affects tinacms
- GHSA-2vcc-5v34-9jc8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing… Also affects tinacms
- GHSA-529f-9qwm-9628 tinacms is vulnerable to arbitrary code execution Also affects tinacms
- CVE-2025-68278 Tina is a headless content management system. Also affects tinacms
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22