CVE-2026-28793 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS
Attackers can read, write, or delete arbitrary files via path traversal in the TinaCMS CLI development server media endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28793?
CVE-2026-28793 is a high-severity path traversal vulnerability in @tinacms cli, published on 12 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.
Weakness: CWE-22
Which versions are affected by CVE-2026-28793?
2 open source packages ship an affected version, including @tinacms/cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@tinacms/cli npm | All versions | 2.1.8 |
@tinacms/cli npm | All versions | 2.1.8 |
Products include Ssw Tinacms\/Cli.
How do I fix CVE-2026-28793?
Upgrade @tinacms/cli to 2.1.8 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-28793 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28793 exists.
Other vulnerabilities in @tinacms cli
- CVE-2026-28792 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
- CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS
- CVE-2024-45391 Tina search token leak via lock file in TinaCMS
- CVE-2026-28791 Path Traversal in Media Upload Handle in Tina
- CVE-2026-34603 @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Sources
Also known as GHSA-2f24-mg4x-534q.