CVE-2026-63123

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63123", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-15T16:54:55.816Z", "datePublished": "2026-08-19T21:41:18.687Z", "dateUpdated": "2026-08-25T14:20:27.175Z"}, "containers": {"cna": {"title": "Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x"}, {"name": "https://github.com/tinacms/tinacms/pull/7111", "tags": ["x_refsource_MISC"], "url": "https://github.com/tinacms/tinacms/pull/7111"}, {"name": "https://github.com/tinacms/tinacms/commit/211997cdb53cbd43638bdee999faa65375cfc260", "tags": ["x_refsource_MISC"], "url": "https://github.com/tinacms/tinacms/commit/211997cdb53cbd43638bdee999faa65375cfc260"}, {"name": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@2.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@2.5.2"}], "affected": [{"vendor": "tinacms", "product": "tinacms", "versions": [{"version": "< 2.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T21:41:18.687Z"}, "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2."}], "source": {"advisory": "GHSA-rgr9-r7mj-mf6x", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T14:19:26.459504Z", "id": "CVE-2026-63123", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:20:27.175Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63123", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:19:26.459504Z"}}}], "references": [{"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:19:38.962Z"}}], "cna": {"title": "Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root", "source": {"advisory": "GHSA-rgr9-r7mj-mf6x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "tinacms", "product": "tinacms", "versions": [{"status": "affected", "version": "< 2.5.2"}]}], "references": [{"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x", "name": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tinacms/tinacms/pull/7111", "name": "https://github.com/tinacms/tinacms/pull/7111", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tinacms/tinacms/commit/211997cdb53cbd43638bdee999faa65375cfc260", "name": "https://github.com/tinacms/tinacms/commit/211997cdb53cbd43638bdee999faa65375cfc260", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@2.5.2", "name": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@2.5.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T21:41:18.687Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63123", "state": "PUBLISHED", "dateUpdated": "2026-08-25T14:20:27.175Z", "dateReserved": "2026-07-15T16:54:55.816Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T21:41:18.687Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tinacms", "vendor": "tinacms", "versions": [{"status": "affected", "version": "< 2.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2."}, {"lang": "es", "value": "Tina es un sistema de gesti\u00f3n de contenido sin interfaz gr\u00e1fica (headless). Antes de la versi\u00f3n 2.5.2, la devoluci\u00f3n de llamada de origen (origin callback) del archivo packages/@tinacms/cli/src/next/vite/cors.ts del servidor de desarrollo Vite del paquete TinaCMS CLI devuelve \u2019false\u2019 para un origen no permitido, pero no rechaza la solicitud, y packages/@tinacms/cli/src/next/vite/plugins.ts a\u00fan enruta POST /media/upload/* a mediaRouter.handlePost. El c\u00f3digo de carga en packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts escribe contenido multipart controlado por el atacante dentro de la ra\u00edz de medios configurada. Un atacante remoto puede hacer que el navegador de un desarrollador env\u00ede esta solicitud que cambia el estado al inducir al desarrollador a visitar una p\u00e1gina controlada por el atacante mientras tinacms dev est\u00e1 en ejecuci\u00f3n. Este problema se solucion\u00f3 en la versi\u00f3n 2.5.2."}], "id": "CVE-2026-63123", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63123", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T14:19:26.459504Z", "version": "2.0.3"}}]}, "published": "2026-08-19T22:16:58.710", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/tinacms/tinacms/commit/211997cdb53cbd43638bdee999faa65375cfc260"}, {"source": "security-advisories@github.com", "url": "https://github.com/tinacms/tinacms/pull/7111"}, {"source": "security-advisories@github.com", "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@2.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.2)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "tinacms", "source": "cna", "vendor": "tinacms"}, "product": "tinacms", "vendor": "tina"}], "created": "2026-08-20T10:45:03.412469+00:00", "updated": "2026-08-21T13:02:27.265545+00:00", "vendors": ["tina", "tina$PRODUCT$tinacms"]}