CVE-2026-28791
High · 7.4CVSS
7.4
EPSS
0.5%
Published
Mar 12, 2026
CISA due date
—
The record
Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. The code at media.ts joins user-controlled path segments using path.join() without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem. This vulnerability is fixed in 2.1.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tinacms | 0 | 2.1.7 |
Related vulnerabilities
- GHSA-5hxf-c7j4-279c Tina: Path Traversal in Media Upload Handle Same vulnerability
- CVE-2026-55661 Tina is a headless content management system. Also affects tinacms
- GHSA-g5qx-h5f3-mp2f TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable… Also affects tinacms
- GHSA-2vcc-5v34-9jc8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing… Also affects tinacms
- GHSA-529f-9qwm-9628 tinacms is vulnerable to arbitrary code execution Also affects tinacms
- CVE-2025-68278 Tina is a headless content management system. Also affects tinacms
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22