CVE-2026-28793

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28793", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T14:25:19.245Z", "datePublished": "2026-03-12T16:50:20.132Z", "dateUpdated": "2026-03-13T16:28:33.184Z"}, "containers": {"cna": {"title": "Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q"}], "affected": [{"vendor": "@tinacms", "product": "cli", "versions": [{"version": "< 2.1.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T16:50:20.132Z"}, "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8."}], "source": {"advisory": "GHSA-2f24-mg4x-534q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:28:28.663530Z", "id": "CVE-2026-28793", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:28:33.184Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28793", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-13T16:28:28.663530Z"}}}], "references": [{"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:28:21.597Z"}}], "cna": {"title": "Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS", "source": {"advisory": "GHSA-2f24-mg4x-534q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "@tinacms", "product": "cli", "versions": [{"status": "affected", "version": "< 2.1.8"}]}], "references": [{"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q", "name": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T16:50:20.132Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28793", "state": "PUBLISHED", "dateUpdated": "2026-03-13T16:28:33.184Z", "dateReserved": "2026-03-03T14:25:19.245Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T16:50:20.132Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cli", "vendor": "@tinacms", "versions": [{"status": "affected", "version": "< 2.1.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ssw:tinacms\\/cli:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "1CE10330-2151-486B-AF99-38DC3D2F8FA0", "versionEndExcluding": "2.1.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8."}, {"lang": "es", "value": "Tina es un sistema de gesti\u00f3n de contenido sin cabeza. Antes de 2.1.8, el servidor de desarrollo CLI de TinaCMS expone puntos finales de medios que son vulnerables a salto de ruta, permitiendo a los atacantes leer y escribir archivos arbitrarios en el sistema de archivos fuera del directorio de medios previsto. Al ejecutar tinacms dev, la CLI inicia un servidor HTTP local (puerto predeterminado 4001) exponiendo puntos finales como /media/list/*, /media/upload/* y /media/*. Estos puntos finales procesan segmentos de ruta controlados por el usuario usando decodeURI() y path.join() sin validar que la ruta resuelta permanezca dentro del directorio de medios configurado. Esta vulnerabilidad est\u00e1 corregida en 2.1.8."}], "id": "CVE-2026-28793", "lastModified": "2026-06-17T10:29:03.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28793", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:28:28.663530Z", "version": "2.0.3"}}]}, "published": "2026-03-12T17:16:50.543", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "cli", "source": "cna", "vendor": "@tinacms"}, "product": "tinacms", "vendor": "tina"}], "analysis": {"en": {"generated_at": "2026-03-18T14:57:46.447055+00:00", "value": {"mitigation_remediation": ["Upgrade the TinaCMS CLI to version 2.1.8 or later."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary file read/write/delete leading to potential full system compromise"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the @tinacms:cli product. Any installation of the TinaCMS CLI older than version 2.1.8 is susceptible. The issue was resolved in update 2.1.8. Those using earlier releases should identify the affected installation and plan an upgrade.", "description_and_impact": "A path traversal vulnerability exists in the TinaCMS CLI development server. The server exposes media endpoints (/media/list/*, /media/upload/*, /media/*) that process user-controlled path segments with decodeURI() and path.join() without verifying that the resolved path remains within the configured media directory. As a result, an attacker can read, modify, or delete any file on the filesystem that the server process can access, potentially exposing sensitive data or tampering with system configuration. The vulnerability is considered a high severity exploit (CVSS 8.4) due to the breadth of impact it allows.", "risk_and_exploitability": "The CVSS score indicates high potential impact, but the EPSS score is below 1%, suggesting exploitation is currently rare. The issue is not listed in the CISA KEV catalog. The attacker requires network access to the local HTTP server started by the CLI on port 4001; if the dev server is bound to localhost, the attack vector is primarily local. Exposure of the dev server to a network could elevate the threat but still requires the attacker to control or intercept traffic to that port."}}}}, "created": "2026-03-13T09:51:00.807840+00:00", "updated": "2026-03-20T15:48:55.483436+00:00", "vendors": ["tina", "tina$PRODUCT$tinacms"]}