CVE-2026-28791: Path Traversal Vulnerability in @tinacms/cli Media Upload Handler
Summary
CVE-2026-28791: Tina: Path Traversal in Media Upload Handle. Affects tinacms versions < 2.1.7. Fixed in 2.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @tinacms/cli package is a command-line interface for TinaCMS, a headless content management system that allows developers to create and manage content in their applications. It provides various functionalities, including a development server for media uploads. However, a critical path traversal vulnerability has been identified in the media upload handler, which could allow unauthorized file access and manipulation.
Vulnerability Detail
A path traversal vulnerability (CWE-22) exists in the media upload handler of the TinaCMS development server. The vulnerability arises from the use of the path.join() function without proper validation of user-controlled input. This allows attackers to craft requests that can write files to arbitrary locations on the filesystem, potentially leading to remote code execution, denial of service, or information disclosure. The vulnerable code is located in the media.ts file, specifically at lines 42-43, where user input is processed without adequate checks.
How To Fix
Latest published version: 3.15.0 as of 23 Oct 2026
npm install tinacms@3.15.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.7
This is the first release that contains the fix.
npm install tinacms@2.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the development server is not exposed to untrusted networks. Additionally, implement custom middleware to validate file paths before they reach the media upload handler, rejecting any requests containing traversal sequences.
Conclusion
The path traversal vulnerability in the @tinacms/cli package poses significant risks to applications using this package. It is crucial to update to the patched version and implement proper path validation to safeguard against potential exploits.
See every vulnerability recorded for tinacms →
FAQ
A path traversal vulnerability allows an attacker to access files and directories stored outside the intended directory by manipulating file paths.
Exploitation of this vulnerability can lead to unauthorized file access, remote code execution, or denial of service, compromising the security of your application.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without signup.
If you cannot update the package, implement custom validation for file paths in your application to mitigate the risk of exploitation.
The CVSS score of this vulnerability is 7.4, indicating a high level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinacms.
