Is CVE-2026-28792 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28792 being exploited in the wild.

How severe is CVE-2026-28792?

Low severity, with a CVSS score of 3.1, published 12 March 2026.

Which products and versions are affected?

@tinacms/cli (npm) SEMVER:introduced=0,fixed=2.1.8.

Is there a fix for CVE-2026-28792?

Yes. @tinacms/cli (npm): upgrade to 2.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28792 attacked?

It is attacked over the network.

Am I affected by CVE-2026-28792?

Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28792: TinaCMS CLI dev server CORS misconfiguration and path traversal

CVE-2026-28792 · Severity: low · CVSS 3.1 · Published 2026-03-12

TinaCMS CLI dev server is a development tool used by content management developers. The server is vulnerable to a browser-based attack where an attacker can trick a developer into visiting a malicious website, allowing the attacker to read sensitive files (like credentials and keys), modify or inject backdoors into project code, and delete files from the developer's machine.

Technologies: @tinacms/cli (npm). Vendors: npm.

Quick answers

Is CVE-2026-28792 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28792 being exploited in the wild.
How severe is CVE-2026-28792?: Low severity, with a CVSS score of 3.1, published 12 March 2026.
Which products and versions are affected?: @tinacms/cli (npm) SEMVER:introduced=0,fixed=2.1.8.
Is there a fix for CVE-2026-28792?: Yes. @tinacms/cli (npm): upgrade to 2.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28792 attacked?: It is attacked over the network.
Am I affected by CVE-2026-28792?: Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@tinacms/cli (npm): upgrade to 2.1.8 or later
```
npm install @tinacms/cli@2.1.8
```

Technical details

The vulnerability combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with a path traversal flaw in the media API endpoints (/media/list/, /media/upload/, /media/ DELETE). An attacker crafts a malicious webpage containing JavaScript that makes cross-origin requests to http://localhost:4001 with path traversal payloads (e.g., /../../../etc/passwd). The misconfigured CORS headers allow the browser to expose the response data, enabling filesystem enumeration, arbitrary file write via /media/upload/, and arbitrary file deletion. The attack requires user interaction (developer visiting malicious site) but no special server configuration—the default dev server setup on port 4001 is exploitable. Patches are available in version 2.1.8 and later.

Affected products

TinaCMS CLI <=2.1.15 (fixed in 2.1.8)

Identifiers

CVE-2026-28792
GHSA-8pw3-9m7f-q734

Timeline

2026-03-12: disclosed
2026-03-12: patched: Fixed in version 2.1.8

References

https://github.com/tinacms/tinacms/security/advisories/GHSA-8pw3-9m7f-q734

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.