CVE-2026-28792 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
Attackers can read, write, and delete files on developer machines via a drive-by attack exploiting CORS and path traversal in TinaCMS CLI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-28792?
CVE-2026-28792 is a critical path traversal vulnerability in @tinacms cli, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.
Which versions are affected by CVE-2026-28792?
2 open source packages ship an affected version, including @tinacms/cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@tinacms/cli npm | All versions | 2.1.8 |
@tinacms/cli npm | All versions | 2.1.8 |
Products include Ssw Tinacms\/Cli.
How do I fix CVE-2026-28792?
Upgrade @tinacms/cli to 2.1.8 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-28792 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28792 exists.
Other vulnerabilities in @tinacms cli
- CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS
- CVE-2026-28793 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS
- CVE-2024-45391 Tina search token leak via lock file in TinaCMS
- CVE-2026-28791 Path Traversal in Media Upload Handle in Tina
- CVE-2026-34603 @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Sources
Also known as GHSA-8pw3-9m7f-q734.