Executive brief
TinaCMS is an open-source headless CMS that includes a development server for managing content and media. The dev server's media endpoints are vulnerable to path traversal attacks, allowing an attacker with local or network access to read, write, and delete arbitrary files on the server's system. This could lead to exposure of sensitive files (like SSH keys or environment variables), injection of malicious code, or service disruption.
Technical details
The vulnerability is a classic path traversal (CWE-22) in the TinaCMS CLI's media endpoint handlers. The vulnerable code uses decodeURI() and path.join() to process user-controlled path segments from HTTP requests (/media/list/*, /media/upload/*, /media/*) without validating that the resolved file path remains within the configured media directory. An attacker can exploit this by including ".." sequences in the request path to traverse directories and access files outside the media root (e.g., /etc/passwd, .env files, SSH keys). The attack vector is local (default localhost binding) but is realistic in cloud IDEs, Docker setups with port forwarding, and misconfigured dev environments binding to 0.0.0.0. The dev server requires no authentication. Depending on the server process's file permissions, attackers can read arbitrary files, write files (enabling code execution if they overwrite scripts or configuration), or delete files. The fix involves validating resolved paths against the media root directory and rejecting ".." segments and absolute paths.
Affected products
- TinaCMS @tinacms/cli <= 2.1.15
Timeline
- 2026-03-12: disclosed
- 2026-03-12: patched: Fixed in version 2.1.8