Executive brief
TinaCMS is an open-source headless CMS that allows developers to manage content stored in GitHub repositories. A path traversal flaw in the media upload handler allows attackers to write files to arbitrary locations on the filesystem, potentially enabling code execution or data manipulation on servers running the development version.
Technical details
The vulnerability is a classic path traversal flaw (CWE-22) in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts at lines 42–43. The code decodes a user-supplied URL path and uses path.join() to combine it with the media folder, but does not validate that the resulting path remains within the intended directory. Since path.join() resolves .. segments, attackers can inject traversal sequences (e.g., ../../../tmp/evil.txt) to write files outside the media folder. The same pattern exists in delete and list handlers, as well as the Express-based server variant. Exploitation requires network access to the media upload endpoint (typically exposed on the development server). While HTTP-layer normalization may mitigate direct curl-based attacks in some configurations, the underlying code lacks protection, making it vulnerable in reverse-proxy scenarios or custom deployments. Patch version 2.1.7 addresses this issue; affected versions are ≤2.0.5.
Affected products
- TinaCMS @tinacms/cli <=2.0.5
Timeline
- 2026-03-12: disclosed: Vulnerability published on GitHub Security Advisory
- 2026-03-14: patched: Patch available in version 2.1.7