What is the CVSS score of CVE-2026-28791?

CVE-2026-28791 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Tinacms Cli are affected by CVE-2026-28791?

A high-severity vulnerability (CVE-2026-28791) exists in TinaCMS with no available patch, potentially exposing organizations using this content management system to unauthorized access or data…. A patch is available.

How to fix or mitigate CVE-2026-28791?

Within 24 hours: Inventory all TinaCMS instances across the organization and assess business criticality. Within 7 days: Implement network segmentation to restrict TinaCMS access to authorized users only, deploy WAF rules to block exploitation attempts, and disable non-essential TinaCMS features if applicable. Within 30 days: Establish daily monitoring for vendor security updates, maintain communication with TinaCMS vendor regarding patch timeline, and evaluate alternative CMS solutions if patch is not released.

Tinacms Cli CVE-2026-28791

HIGH

Path Traversal (CWE-22)

2026-03-12 security-advisories@github.com

GHSA-5hxf-c7j4-279c

Path Traversal Tinacms Cli Ssw

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 17:16 nvd

HIGH 7.4

DescriptionGitHub Advisory

Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. The code at media.ts joins user-controlled path segments using path.join() without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem. This vulnerability is fixed in 2.1.7.

AnalysisAI

High severity vulnerability in TinaCMS.

Affected Package

Technical ContextAI

Vulnerability Type: Path Traversal (CWE-22) CVSS 3.1: 7.4/10.0 — Attack Vector: Network | Complexity: High | Privileges Required: None | User Interaction: None Attack Techniques: Information Disclosure, Path Traversal, Denial Of Service, Rce Source: https://github.com/tinacms/tinacms Path traversal allows access to files outside the intended directory by manipulating file paths with sequences like '../'.