Executive brief
Tina is a headless CMS used by developers for content management. Its local development server includes a media upload feature that allows developers to upload files during development. A flaw in the dev server's CORS implementation allows attackers to trick developers into visiting a malicious website that silently creates arbitrary files in the project's upload directory without any user action or manual upload—merely by opening an attacker-controlled page in a browser while the dev server runs. This compromises the integrity of local project files.
Technical details
The vulnerability is a cross-site request forgery (CSRF) flaw in the @tinacms/cli dev server component. The Vite dev server implements CORS middleware with a custom origin check callback that returns false for disallowed origins, but this does not reject the request server-side. The upload handler at `/media/upload/*` then unconditionally accepts and processes requests regardless of CORS rejection, decoding the URL path and writing attacker-supplied file content to the configured media folder. The root cause is that the CORS library's false return only prevents the browser from reading the response; it does not stop the server from executing the state-changing request. Because multipart/form-data is a simple content-type, no preflight CORS check is required by the browser, making the attack browser-transparent. An attacker can host a malicious page that uses fetch() or an HTML form to POST files to the localhost dev server, resulting in file creation inside the media root. Patch 2.5.2 of @tinacms/cli addresses this by properly rejecting disallowed cross-origin requests server-side before routing them to the upload handler.
Affected products
- TinaCMS @tinacms/cli < 2.5.2
Timeline
- 2026-08-19: disclosed: Published to GitHub Advisory Database
- 2026-08-19: patched: Patched in @tinacms/cli@2.5.2