CVE-2026-28793
published 2026-03-12CVE-2026-28793: Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal…
PriorityP350high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.20%
10.3th percentile
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ssw | tinacms_cli | < 2.1.8 | 2.1.8 |
| tinacms | cli | < 2.1.8 | 2.1.8 |
| tinacms | cli | >= 0 < 2.1.8 | 2.1.8 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
ghsa·2026-03-12
CVE-2026-28793 [HIGH] CWE-22 TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
## Summary
The TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory.
## Details
When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as:
- /media/list/*
- /media/upload/*
- /media/*
These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory.
### Vulnerable code
```
bb.on('file', async (_name, file, _info) => {
const fullPath = decodeURI(req.url?.slice('/media/upload/'.length));
const sa
OSV
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
osv·2026-03-12
CVE-2026-28793 [HIGH] TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
## Summary
The TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory.
## Details
When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as:
- /media/list/*
- /media/upload/*
- /media/*
These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory.
### Vulnerable code
```
bb.on('file', async (_name, file, _info) => {
const fullPath = decodeURI(req.url?.slice('/media/upload/'.length));
const sa
No detection rules found.
No public exploits indexed.
2026-03-12
Published