Plataforma
nodejs
Componente
tinacms
Corrigido em
2.1.8
2.1.7
A path traversal vulnerability has been identified in the @tinacms/cli package, specifically within the development server's media upload handler. This flaw (CWE-22) allows attackers to potentially write files outside of the intended media directory, leading to arbitrary file write capabilities. The vulnerability affects versions up to 2.0.5 and is resolved in version 2.1.7.
The core of the vulnerability lies in the media.ts file, where user-controlled path segments are joined using path.join() without proper validation. This lack of validation allows an attacker to craft malicious requests that manipulate the file path, enabling them to write files to arbitrary locations on the server's file system. Successful exploitation could lead to the modification or replacement of critical system files, potentially resulting in remote code execution and complete system compromise. The blast radius extends to any environment utilizing the vulnerable @tinacms/cli version for development, as the development server is often exposed during testing and debugging.
This vulnerability was publicly disclosed on 2026-03-12. No public proof-of-concept (PoC) code has been released at the time of writing, but the ease of exploitation suggests that a PoC is likely to emerge. The vulnerability is not currently listed on CISA KEV, and there are no reports of active exploitation campaigns. The CVSS score of 7.4 (HIGH) indicates a significant risk.
Development teams utilizing @tinacms/cli for content management system development are at immediate risk. Specifically, those using versions 2.0.5 or earlier, and those running the development server in environments with inadequate file system permissions, are particularly vulnerable. Shared hosting environments where the development server might be accessible from the public internet are also at heightened risk.
• nodejs / server:
npm list @tinacms/cli• nodejs / server:
grep -r "path.join()" packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts• generic web:
Inspect media upload endpoints for unusual file paths in request parameters. Monitor access logs for requests containing path traversal sequences (e.g., ../).
disclosure
Status do Exploit
EPSS
0.08% (percentil 23%)
CISA SSVC
Vetor CVSS
The primary mitigation is to immediately upgrade to @tinacms/cli version 2.1.7 or later. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting file upload permissions within the media directory. Implement strict input validation on all user-provided file paths within the media upload handler to ensure they remain within the intended directory. Monitor file system activity for unexpected file creations or modifications within the media directory. After upgrading, confirm the fix by attempting a file upload with a crafted path traversal payload and verifying that the upload is rejected.
Actualice TinaCMS a la versión 2.1.7 o superior. Esta versión corrige la vulnerabilidad de path traversal en el manejo de la carga de medios.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2026-28791 is a Path Traversal vulnerability in the @tinacms/cli package, allowing attackers to write files outside the intended media directory.
You are affected if you are using @tinacms/cli versions 2.0.5 or earlier.
Upgrade to @tinacms/cli version 2.1.7 or later. Implement input validation as a temporary workaround.
There are currently no reports of active exploitation, but the vulnerability's ease of exploitation suggests a potential for future attacks.
Refer to the official @tinacms/cli release notes and security advisories on their website or GitHub repository.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.