CVE-2026-28791
published 2026-03-12CVE-2026-28791: Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler…
PriorityP350high7.4CVSS 3.1
AVNACHPRNUINSUCNIHAH
EPSS
0.33%
24.2th percentile
Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. The code at media.ts joins user-controlled path segments using path.join() without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem. This vulnerability is fixed in 2.1.7.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ssw | tinacms_cli | < 2.1.7 | 2.1.7 |
| tinacms | tinacms | < 2.1.7 | 2.1.7 |
| tinacms | tinacms | >= 0 < 2.1.7 | 2.1.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tina: Path Traversal in Media Upload Handle
ghsa·2026-03-12
CVE-2026-28791 [HIGH] CWE-22 Tina: Path Traversal in Media Upload Handle
Tina: Path Traversal in Media Upload Handle
## Affected Package
| Field | Value |
|-------|-------|
| **Package** | `@tinacms/cli` |
| **Version** | `2.0.5` (latest at time of discovery) |
| **Vulnerable File** | `packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts` |
| **Vulnerable Lines** | 42-43 |
---
## Summary
A **path traversal vulnerability (CWE-22)** exists in the TinaCMS development server's media upload handler. The code at `media.ts:42-43` joins user-controlled path segments using `path.join()` without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem.
**Attack Vector**: Network (HTTP POST request)
**Impact**: Arbitrary file write, potential Remote Code Execution
OSV
Tina: Path Traversal in Media Upload Handle
osv·2026-03-12
CVE-2026-28791 [HIGH] Tina: Path Traversal in Media Upload Handle
Tina: Path Traversal in Media Upload Handle
## Affected Package
| Field | Value |
|-------|-------|
| **Package** | `@tinacms/cli` |
| **Version** | `2.0.5` (latest at time of discovery) |
| **Vulnerable File** | `packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts` |
| **Vulnerable Lines** | 42-43 |
---
## Summary
A **path traversal vulnerability (CWE-22)** exists in the TinaCMS development server's media upload handler. The code at `media.ts:42-43` joins user-controlled path segments using `path.join()` without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem.
**Attack Vector**: Network (HTTP POST request)
**Impact**: Arbitrary file write, potential Remote Code Execution
No detection rules found.
No public exploits indexed.
2026-03-12
Published