Is CVE-2026-28793 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28793 being exploited in the wild.

How severe is CVE-2026-28793?

Low severity, with a CVSS score of 3.1, published 12 March 2026.

Which products and versions are affected?

@tinacms/cli (npm) SEMVER:introduced=0,fixed=2.1.8.

Is there a fix for CVE-2026-28793?

Yes. @tinacms/cli (npm): upgrade to 2.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28793 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-28793?

Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28793: TinaCMS CLI path traversal in media endpoints

CVE-2026-28793 · Severity: low · CVSS 3.1 · Published 2026-03-12

TinaCMS is an open-source headless CMS that includes a development server for managing content and media. The dev server's media endpoints are vulnerable to path traversal attacks, allowing an attacker with local or network access to read, write, and delete arbitrary files on the server's system. This could lead to exposure of sensitive files (like SSH keys or environment variables), injection of malicious code, or service disruption.

Technologies: @tinacms/cli (npm). Vendors: npm.

Quick answers

Is CVE-2026-28793 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28793 being exploited in the wild.
How severe is CVE-2026-28793?: Low severity, with a CVSS score of 3.1, published 12 March 2026.
Which products and versions are affected?: @tinacms/cli (npm) SEMVER:introduced=0,fixed=2.1.8.
Is there a fix for CVE-2026-28793?: Yes. @tinacms/cli (npm): upgrade to 2.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28793 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-28793?: Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@tinacms/cli (npm): upgrade to 2.1.8 or later
```
npm install @tinacms/cli@2.1.8
```

Technical details

The vulnerability is a classic path traversal (CWE-22) in the TinaCMS CLI's media endpoint handlers. The vulnerable code uses decodeURI() and path.join() to process user-controlled path segments from HTTP requests (/media/list/*, /media/upload/*, /media/*) without validating that the resolved file path remains within the configured media directory. An attacker can exploit this by including ".." sequences in the request path to traverse directories and access files outside the media root (e.g., /etc/passwd, .env files, SSH keys). The attack vector is local (default localhost binding) but is realistic in cloud IDEs, Docker setups with port forwarding, and misconfigured dev environments binding to 0.0.0.0. The dev server requires no authentication. Depending on the server process's file permissions, attackers can read arbitrary files, write files (enabling code execution if they overwrite scripts or configuration), or delete files. The fix involves validating resolved paths against the media root directory and rejecting ".." segments and absolute paths.

Affected products

TinaCMS @tinacms/cli <= 2.1.15

Identifiers

CVE-2026-28793
GHSA-2f24-mg4x-534q

Timeline

2026-03-12: disclosed
2026-03-12: patched: Fixed in version 2.1.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.