CVE-2026-28792: falha crítica em @tinacms cli
Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.7epss 0.6%
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
@tinacms · cliCVEs relacionadas — @tinacms cli
No mesmo produto, das mais perigosas para as menos.
CVE-2026-29066MEDIUMArbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLIEPSS 1.0%CVE-2026-108259HIGHTina: Code injection via unescaped Git branch name in generated client sourceEPSS 0.3%CVE-2026-28793HIGHPath Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMSEPSS 0.2%