Executive brief
TinaCMS CLI dev server is a development tool used by content management developers. The server is vulnerable to a browser-based attack where an attacker can trick a developer into visiting a malicious website, allowing the attacker to read sensitive files (like credentials and keys), modify or inject backdoors into project code, and delete files from the developer's machine.
Technical details
The vulnerability combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with a path traversal flaw in the media API endpoints (/media/list/, /media/upload/, /media/ DELETE). An attacker crafts a malicious webpage containing JavaScript that makes cross-origin requests to http://localhost:4001 with path traversal payloads (e.g., /../../../etc/passwd). The misconfigured CORS headers allow the browser to expose the response data, enabling filesystem enumeration, arbitrary file write via /media/upload/, and arbitrary file deletion. The attack requires user interaction (developer visiting malicious site) but no special server configuration—the default dev server setup on port 4001 is exploitable. Patches are available in version 2.1.8 and later.
Affected products
- TinaCMS CLI <=2.1.15 (fixed in 2.1.8)
Timeline
- 2026-03-12: disclosed
- 2026-03-12: patched: Fixed in version 2.1.8