HIGH🇵🇱 Wersja polska

CVE-2026-28791

CVSS 7.4v3.1pub. 2026-03-12upd. 2026-03-13

Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. The code at media.ts joins user-controlled path segments using path.join() without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem. This vulnerability is fixed in 2.1.7.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Ssw Tinacms\/cli

    APP
    Ssw
    < 2.1.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2026-28792CRITICAL9.6PL ✓ten sam produkt

TinaCMS CLI: path traversal + CORS umożliwiają atak drive-by na deweloperów

CVE-2026-34603HIGH7.1ten sam produkt

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path...

CVE-2026-28793HIGH8.4ten sam produkt

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media...

CVE-2025-68278HIGH7.3ten sam produkt

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter ...

CVE-2024-45391HIGH7.5ten sam produkt

Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface ...