Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
Vulnerability Description
Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The impact includes the ability to replace critical server configuration files and potentially execute arbitrary commands by sabotaging build script. This issue has been patched in version 2.2.2.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
TinaCMS 安全漏洞
Vulnerability Description
TinaCMS是Tina开源的一个用于 Markdown、MDX 和 JSON 的开源无头 CMS。 TinaCMS 2.2.2之前版本存在安全漏洞，该漏洞源于@tinacms/graphql存在路径遍历，未经验证的用户可通过操作GraphQL突变中的relativePath参数在项目根目录内写入和覆盖任意文件，可能导致替换关键服务器配置文件和通过破坏构建脚本执行任意命令。
CVSS Information
N/A
Vulnerability Type
N/A