# CVE-2026-63123: TinaCMS CLI cross-origin CSRF in media upload

Source: https://junglewise.ai/threats/cve-2026-63123-tinacms-cli-cross-origin-csrf-in-media-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63123 · Severity: medium · CVSS 6.5 · Published 2026-08-19

Tina is a headless CMS used by developers for content management. Its local development server includes a media upload feature that allows developers to upload files during development. A flaw in the dev server's CORS implementation allows attackers to trick developers into visiting a malicious website that silently creates arbitrary files in the project's upload directory without any user action or manual upload—merely by opening an attacker-controlled page in a browser while the dev server runs. This compromises the integrity of local project files.

Technologies: [@tinacms/cli (npm)](https://junglewise.ai/threats/technologies/tinacms-cli). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-63123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63123 being exploited in the wild.

**How severe is CVE-2026-63123?** Medium severity, with a CVSS score of 6.5, published 19 August 2026.

**Which products and versions are affected?** @tinacms/cli (npm) < 2.5.2, SEMVER:introduced=0,fixed=2.5.2.

**Is there a fix for CVE-2026-63123?** Yes. @tinacms/cli (npm): upgrade to 2.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63123 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63123?** Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @tinacms/cli (npm): upgrade to 2.5.2 or later

  ```sh
  npm install @tinacms/cli@2.5.2
  ```


## Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw in the @tinacms/cli dev server component. The Vite dev server implements CORS middleware with a custom origin check callback that returns false for disallowed origins, but this does not reject the request server-side. The upload handler at `/media/upload/*` then unconditionally accepts and processes requests regardless of CORS rejection, decoding the URL path and writing attacker-supplied file content to the configured media folder. The root cause is that the CORS library's false return only prevents the browser from reading the response; it does not stop the server from executing the state-changing request. Because multipart/form-data is a simple content-type, no preflight CORS check is required by the browser, making the attack browser-transparent. An attacker can host a malicious page that uses fetch() or an HTML form to POST files to the localhost dev server, resulting in file creation inside the media root. Patch 2.5.2 of @tinacms/cli addresses this by properly rejecting disallowed cross-origin requests server-side before routing them to the upload handler.

## Affected products

- TinaCMS @tinacms/cli < 2.5.2

## Identifiers

- CVE-2026-63123
- GHSA-rgr9-r7mj-mf6x

## Timeline

- 2026-08-19: disclosed: Published to GitHub Advisory Database
- 2026-08-19: patched: Patched in @tinacms/cli@2.5.2

## References

- [https://api.github.com/users/Zwique](https://api.github.com/users/Zwique)
- [https://github.com/Zwique](https://github.com/Zwique)
- [https://api.github.com/users/Zwique/gists%7B/gist_id%7D](https://api.github.com/users/Zwique/gists%7B/gist_id%7D)
- [https://api.github.com/users/Zwique/repos](https://api.github.com/users/Zwique/repos)
- [https://avatars.githubusercontent.com/u/97537483?v=4](https://avatars.githubusercontent.com/u/97537483?v=4)
- [https://api.github.com/users/Zwique/events%7B/privacy%7D](https://api.github.com/users/Zwique/events%7B/privacy%7D)

## Related threats

- [TinaCMS CLI code injection via unescaped Git branch name](https://junglewise.ai/threats/cve-2026-108259-tina-code-injection-via-unescaped-git-branch-name-in-generated)
- [TinaCMS @tinacms/cli Remote Code Execution in Forestry migration](https://junglewise.ai/threats/cve-2026-54074-tinacms-tinacms-cli-remote-code-execution-in-forestry-migration)
- [TinaCMS CLI arbitrary file read via disabled Vite filesystem restriction](https://junglewise.ai/threats/cve-2026-29066-tinacms-cli-arbitrary-file-read-via-disabled-vite-filesystem)
- [TinaCMS CLI path traversal in media endpoints](https://junglewise.ai/threats/cve-2026-28793-tinacms-path-traversal-in-cli-development-server-media-endpoints)
- [TinaCMS CLI dev server CORS misconfiguration and path traversal](https://junglewise.ai/threats/cve-2026-28792-tinacms-cli-dev-server-cors-misconfiguration-and-path-traversal)