CVE-2026-28793 — Path Traversal in CLI

CWE-22 — Path Traversal5 documents5 sources
Severity
8.4HIGHNVD
EPSS
0.0%
top 93.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Tinacms CLISSW Tinacms CLI
Timeline
PublishedMar 12

Description

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and p…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.5 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5tinacms/cli< 2.1.8
▶npmtinacms/cli< 2.1.8
▶NVDssw/tinacms_cli< 2.1.8

🔴Vulnerability Details

3
GHSA
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete↗2026-03-12
▶
OSV
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete↗2026-03-12
▶
CVEList
Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS↗2026-03-12
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-28793 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-28793 — Path Traversal in Tinacms CLI | cvebase