CVE-2026-28793: falha de alta gravidade em @tinacms cli
Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.2%
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
@tinacms · cliCVEs relacionadas — @tinacms cli
No mesmo produto, das mais perigosas para as menos.
CVE-2026-29066MEDIUMArbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLIEPSS 1.0%CVE-2026-28792CRITICALCross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMSEPSS 0.6%CVE-2026-108259HIGHTina: Code injection via unescaped Git branch name in generated client sourceEPSS 0.3%