A critical path traversal vulnerability in TinaCMS versions prior to 2.2.2 permits unauthorized file overwriting, posing a significant risk of remote code execution.

This vulnerability is a path traversal flaw located in the @tinacms/graphql package, which allows for the writing and overwriting of arbitrary files within the project root. By manipulating the relativePath parameter in GraphQL mutations, an attacker can modify critical configuration files or sabotage build scripts.

The ability to overwrite arbitrary files on the server constitutes a severe security risk, as it can lead to full system compromise through the execution of malicious code. Given the CVSS score of 8.1, this vulnerability represents a high risk of unauthorized data modification and potential service disruption, which could result in significant operational downtime and loss of integrity for the affected CMS environment.

Immediate Action: Update the @tinacms/graphql package to version 2.2.2 or later immediately to resolve the path traversal flaw.

Proactive Monitoring: Audit server access logs for unusual GraphQL mutation patterns, specifically monitoring requests that utilize the relativePath parameter for signs of directory traversal attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious input containing directory traversal sequences, such as dot-dot-slash patterns, directed at GraphQL endpoints.

Public Exploit Available: Unknown.

The severity of this path traversal vulnerability necessitates an immediate update to the patched version of the TinaCMS GraphQL package. Security teams should prioritize this remediation to prevent potential remote code execution and ensure the integrity of the application server. Failure to patch leaves the environment susceptible to configuration manipulation and unauthorized system access.