CVE-2026-28793: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28793 is a path traversal vulnerability (CWE-22) in the TinaCMS CLI development server, titled "Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS." It affects the @tinacms/cli npm package in all versions prior to 2.1.8, allowing attackers with access to the dev server to read, write, and delete arbitrary files outside the intended media directory. The vulnerability was published on March 12, 2026, and fixed in version 2.1.8. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, TinaCMS Advisory).

The root cause is improper path validation (CWE-22) in the TinaCMS CLI's local HTTP server media endpoints (/media/list/*, /media/upload/*, and /media/*). User-controlled URL path segments are processed using decodeURI() followed by path.join() without any check that the resolved path remains within the configured media directory, enabling classic ../ traversal sequences to escape the media root. The vulnerable code pattern is: const fullPath = decodeURI(req.url?.slice('/media/upload/'.length)); const saveTo = path.join(mediaFolder, ...fullPath.split('/')); — with no boundary enforcement after path resolution. Proof-of-concept exploit commands using curl with --path-as-is and traversal payloads are publicly documented in the advisory (TinaCMS Advisory, GitHub Advisory).

An attacker who can reach the TinaCMS CLI dev server can read sensitive files (e.g., /etc/passwd, .env files, SSH keys), write arbitrary content to any path writable by the server process, and delete or overwrite files via the DELETE endpoint. In realistic development environments — including cloud IDEs (GitHub Codespaces, Gitpod), Docker setups with port forwarding, or misconfigured environments binding to 0.0.0.0 — this can escalate to remote code execution by overwriting watched source files, configuration files, or executable scripts. The server's permissive CORS configuration may additionally enable browser-based exploitation if the dev server is externally reachable (TinaCMS Advisory).

A public proof-of-concept is available in the official GitHub Security Advisory, consisting of concrete curl commands that demonstrate file read, write, and delete without requiring authentication or special privileges. The EPSS score is approximately 0.034% (0.000180 per Feedly), indicating low current exploitation probability. No in-the-wild exploitation or threat actor attribution has been reported as of the advisory date. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, TinaCMS Advisory).

1. Reconnaissance: Identify a running TinaCMS CLI dev server (default port 4001) on localhost, a cloud IDE, or a Docker/VM environment with port forwarding. Scan for open port 4001 or check for tinacms dev processes.
2. Arbitrary File Read: Send a crafted GET request with ../ traversal sequences to the /media/list/ endpoint:

   curl "http://localhost:4001/media/list/../../../etc/passwd"

   The server decodes the URI and resolves the path without boundary checks, returning the contents of /etc/passwd.
3. Arbitrary File Write: Prepare a payload file and upload it to an arbitrary path using the /media/upload/ endpoint with the --path-as-is flag to prevent client-side path normalization:

   echo "ATTACKER_CONTROLLED_CONTENT" > /tmp/payload.txt
   curl --path-as-is -X POST \
     "http://localhost:4001/media/upload/../../../../../../tmp/pwned.txt" \
     -F "file=@/tmp/payload.txt"

4. Arbitrary File Delete: Delete a target file using the /media/ DELETE endpoint:

   curl --path-as-is -X DELETE \
     "http://localhost:4001/media/../../../../../../tmp/delete-test.txt"

5. Escalate to Code Execution: Overwrite a watched source file, startup script, or configuration file (e.g., .env, a Node.js entry point) with attacker-controlled content. In development environments with hot-reload, this may trigger automatic execution of the injected code (TinaCMS Advisory, GitHub Advisory).

• Network: Unexpected HTTP GET/POST/DELETE requests to port 4001 containing ../ or URL-encoded traversal sequences (e.g., %2e%2e%2f) in paths targeting /media/list/, /media/upload/, or /media/; outbound connections from the dev server process to unknown hosts following file write activity.
• Logs: HTTP access logs for the TinaCMS dev server showing requests with path traversal patterns such as /media/list/../../../etc/passwd or /media/upload/../../../../../../tmp/; requests originating from unexpected source IPs (non-localhost) to port 4001.
• File System: Unexpected files created or modified outside the configured TinaCMS media directory (e.g., in /tmp/, home directories, or project root); modifications to .env, source files, or configuration files with timestamps coinciding with suspicious HTTP activity; missing files that were unexpectedly deleted.
• Process: Unusual child processes spawned by the Node.js TinaCMS dev server process following file write events (indicative of code execution via overwritten scripts or config files) (TinaCMS Advisory).

Upgrade @tinacms/cli to version 2.1.8 or later, which resolves the path traversal by enforcing that resolved paths remain within the configured media root. As interim workarounds: restrict access to the dev server port (default 4001) using firewall rules or network policies to allow only trusted hosts; avoid binding the dev server to 0.0.0.0 in shared or cloud environments; and audit any environment where tinacms dev is run in multi-user or internet-accessible contexts. The advisory also recommends rejecting .. path segments and absolute paths at the endpoint level, and considering authentication or token protection for dev server endpoints (TinaCMS Advisory, GitHub Advisory).

The vulnerability was credited to researcher alaeddine03 who reported it to the TinaCMS project. Brief coverage appeared on security aggregator sites including CVEFeed, VulDB, and INCIBE-CERT shortly after disclosure. No significant vendor statements beyond the official advisory or notable researcher commentary beyond the PoC documentation have been identified (TinaCMS Advisory).