# CVE-2026-28791: TinaCMS path traversal in media upload handler

Source: https://junglewise.ai/threats/cve-2026-28791-tinacms-path-traversal-in-media-upload-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-28791 · Severity: low · CVSS 3.1 · Published 2026-03-12

TinaCMS is an open-source headless CMS that allows developers to manage content stored in GitHub repositories. A path traversal flaw in the media upload handler allows attackers to write files to arbitrary locations on the filesystem, potentially enabling code execution or data manipulation on servers running the development version.

Technologies: [tinacms (npm)](https://junglewise.ai/threats/technologies/tinacms). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-28791 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28791 being exploited in the wild.

**How severe is CVE-2026-28791?** Low severity, with a CVSS score of 3.1, published 12 March 2026.

**Which products and versions are affected?** tinacms (npm) SEMVER:introduced=0,fixed=2.1.7.

**Is there a fix for CVE-2026-28791?** Yes. tinacms (npm): upgrade to 2.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28791 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-28791?** Check whether you run tinacms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tinacms (npm): upgrade to 2.1.7 or later

  ```sh
  npm install tinacms@2.1.7
  ```


## Technical details

The vulnerability is a classic path traversal flaw (CWE-22) in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts at lines 42–43. The code decodes a user-supplied URL path and uses path.join() to combine it with the media folder, but does not validate that the resulting path remains within the intended directory. Since path.join() resolves .. segments, attackers can inject traversal sequences (e.g., ../../../tmp/evil.txt) to write files outside the media folder. The same pattern exists in delete and list handlers, as well as the Express-based server variant. Exploitation requires network access to the media upload endpoint (typically exposed on the development server). While HTTP-layer normalization may mitigate direct curl-based attacks in some configurations, the underlying code lacks protection, making it vulnerable in reverse-proxy scenarios or custom deployments. Patch version 2.1.7 addresses this issue; affected versions are ≤2.0.5.

## Affected products

- TinaCMS @tinacms/cli <=2.0.5

## Identifiers

- CVE-2026-28791
- GHSA-5hxf-c7j4-279c

## Timeline

- 2026-03-12: disclosed: Vulnerability published on GitHub Security Advisory
- 2026-03-14: patched: Patch available in version 2.1.7

## References

- [https://github.com/tinacms/tinacms/security/advisories/GHSA-5hxf-c7j4-279c](https://github.com/tinacms/tinacms/security/advisories/GHSA-5hxf-c7j4-279c)
- [https://github.com/tinacms/tinacms](https://github.com/tinacms/tinacms)

## Related threats

- [TinaCMS admin preview iframe origin validation bypass](https://junglewise.ai/threats/cve-2026-108261-tinacms-admin-preview-iframe-loads-an-attacker-controlled-origin)
- [TinaCMS stored XSS in rich-text link and image rendering](https://junglewise.ai/threats/cve-2026-55661-tinacms-stored-xss-in-rich-text-link-and-image-rendering)
- [TinaCMS origin validation error in postMessage handlers](https://junglewise.ai/threats/cve-2026-55660-tinacms-origin-validation-error-in-postmessage-handlers)
- [TinaCMS arbitrary code execution in markdown frontmatter](https://junglewise.ai/threats/cve-2025-68278-tinacms-arbitrary-code-execution-in-markdown-frontmatter)