CVE-2026-28793: TinaCMS CLI Path Traversal Vulnerability Leading to Arbitrary File Operations
Summary
CVE-2026-28793: TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete. Affects @tinacms/cli versions < 2.1.8. Fixed in 2.1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinaCMS is an open-source content management system (CMS) designed for developers to create and manage content easily. The TinaCMS CLI provides a development server that allows users to upload and manage media files. However, it has been found to have a critical vulnerability that exposes it to path traversal attacks, enabling unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from the TinaCMS CLI development server exposing media endpoints that do not properly validate user-controlled path segments. This oversight allows attackers to exploit the server by using path traversal techniques to read, write, and delete arbitrary files on the filesystem outside the intended media directory. The endpoints affected include /media/list/, /media/upload/, and /media/*. The lack of validation in the code allows for exploitation, leading to potential data breaches and unauthorized modifications.
How To Fix
Latest published version: 4.0.3 as of 22 Oct 2026
npm install @tinacms/cli@4.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.8
This is the first release that contains the fix.
npm install @tinacms/cli@2.1.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the development server by binding it to localhost only and ensuring it is not exposed to the internet. However, this does not fully mitigate the risk and should not be considered a permanent solution.
Conclusion
The TinaCMS CLI vulnerability (CVE-2026-28793) poses a significant risk due to its path traversal nature, allowing unauthorized file access and manipulation. Immediate action is required to update the package and implement necessary security measures to protect against potential exploitation.
See every vulnerability recorded for @tinacms/cli →
FAQ
The CVSS score of this vulnerability is 8.4, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
An attacker can read sensitive files such as /etc/passwd, .env files, and SSH keys, as well as write or delete files anywhere writable by the server process.
Yes, the vulnerability can be exploited in cloud IDEs, Docker or VM setups with port forwarding, and misconfigured development environments.
The consequences include unauthorized access to sensitive information, data loss through file deletion, and potential escalation to code execution by overwriting critical files.
References
Related vulnerabilities
Recent vulnerabilities recorded for @tinacms/cli.
