CVE-2026-28791
HIGH
GHSA-5hxf-c7j4-279c
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3Tags
Description
Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. The code at media.ts joins user-controlled path segments using path.join() without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem. This vulnerability is fixed in 2.1.7.
Analysis
High severity vulnerability in TinaCMS. ## Affected Package
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Inventory all TinaCMS instances across the organization and assess business criticality. Within 7 days: Implement network segmentation to restrict TinaCMS access to authorized users only, deploy WAF rules to block exploitation attempts, and disable non-essential TinaCMS features if applicable. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today