CVE-2026-28791 Path Traversal in Media Upload Handle in Tina

What is CVE-2026-28791?

CVE-2026-28791 is a high-severity path traversal vulnerability in tinacms, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. The code at media.ts joins user-controlled path segments using path.join() without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem. This vulnerability is fixed in 2.1.7.

Weakness: CWE-22

Which versions are affected by CVE-2026-28791?

2 open source packages ship an affected version, including tinacms. It affects 1 product.

Products include Ssw Tinacms\/Cli.

How do I fix CVE-2026-28791?

Upgrade tinacms to 2.1.7 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-28791 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28791 exists.

Other vulnerabilities in tinacms

• CVE-2026-28792 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS Critical 9.7
• CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS High 8.6
• CVE-2026-28793 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS High 8.4
• CVE-2024-45391 Tina search token leak via lock file in TinaCMS High 7.5
• CVE-2026-34603 @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5hxf-c7j4-279c.