# CVE-2026-28792: TinaCMS CLI dev server CORS misconfiguration and path traversal

Source: https://junglewise.ai/threats/cve-2026-28792-tinacms-cli-dev-server-cors-misconfiguration-and-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-28792 · Severity: low · CVSS 3.1 · Published 2026-03-12

TinaCMS CLI dev server is a development tool used by content management developers. The server is vulnerable to a browser-based attack where an attacker can trick a developer into visiting a malicious website, allowing the attacker to read sensitive files (like credentials and keys), modify or inject backdoors into project code, and delete files from the developer's machine.

Technologies: [@tinacms/cli (npm)](https://junglewise.ai/threats/technologies/tinacms-cli). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-28792 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28792 being exploited in the wild.

**How severe is CVE-2026-28792?** Low severity, with a CVSS score of 3.1, published 12 March 2026.

**Which products and versions are affected?** @tinacms/cli (npm) SEMVER:introduced=0,fixed=2.1.8.

**Is there a fix for CVE-2026-28792?** Yes. @tinacms/cli (npm): upgrade to 2.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28792 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-28792?** Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @tinacms/cli (npm): upgrade to 2.1.8 or later

  ```sh
  npm install @tinacms/cli@2.1.8
  ```


## Technical details

The vulnerability combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with a path traversal flaw in the media API endpoints (/media/list/, /media/upload/, /media/ DELETE). An attacker crafts a malicious webpage containing JavaScript that makes cross-origin requests to http://localhost:4001 with path traversal payloads (e.g., /../../../etc/passwd). The misconfigured CORS headers allow the browser to expose the response data, enabling filesystem enumeration, arbitrary file write via /media/upload/, and arbitrary file deletion. The attack requires user interaction (developer visiting malicious site) but no special server configuration—the default dev server setup on port 4001 is exploitable. Patches are available in version 2.1.8 and later.

## Affected products

- TinaCMS CLI <=2.1.15 (fixed in 2.1.8)

## Identifiers

- CVE-2026-28792
- GHSA-8pw3-9m7f-q734

## Timeline

- 2026-03-12: disclosed
- 2026-03-12: patched: Fixed in version 2.1.8

## References

- [https://github.com/tinacms/tinacms/security/advisories/GHSA-8pw3-9m7f-q734](https://github.com/tinacms/tinacms/security/advisories/GHSA-8pw3-9m7f-q734)

## Related threats

- [TinaCMS CLI code injection via unescaped Git branch name](https://junglewise.ai/threats/cve-2026-108259-tina-code-injection-via-unescaped-git-branch-name-in-generated)
- [TinaCMS CLI cross-origin CSRF in media upload](https://junglewise.ai/threats/cve-2026-63123-tinacms-cli-cross-origin-csrf-in-media-upload)
- [TinaCMS @tinacms/cli Remote Code Execution in Forestry migration](https://junglewise.ai/threats/cve-2026-54074-tinacms-tinacms-cli-remote-code-execution-in-forestry-migration)
- [TinaCMS CLI arbitrary file read via disabled Vite filesystem restriction](https://junglewise.ai/threats/cve-2026-29066-tinacms-cli-arbitrary-file-read-via-disabled-vite-filesystem)
- [TinaCMS CLI path traversal in media endpoints](https://junglewise.ai/threats/cve-2026-28793-tinacms-path-traversal-in-cli-development-server-media-endpoints)