What is the CVSS score of CVE-2026-28793?

CVE-2026-28793 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tinacms Cli are affected by CVE-2026-28793?

TinaCMS development servers are vulnerable to arbitrary file read/write attacks through path traversal in media endpoints, potentially exposing sensitive data and enabling system compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2026-28793?

Yes, a public proof-of-concept exploit is available for CVE-2026-28793. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-28793?

Within 24 hours: Identify all TinaCMS instances in your environment and document their network exposure (internal vs. internet-facing). Within 7 days: Implement network segmentation to restrict access to TinaCMS development servers to authorized internal networks only, disable the CLI development server if not actively in use, and monitor file access logs for suspicious activity. Within 30 days: Evaluate migration to alternative CMS solutions or secure containerized deployments with strict filesystem permissions, monitor vendor advisories for patch availability, and conduct security assessment of any files potentially accessed during exposure window.

Tinacms Cli CVE-2026-28793

HIGH

Path Traversal (CWE-22)

2026-03-12 security-advisories@github.com

GHSA-2f24-mg4x-534q

Path Traversal Tinacms Cli Ssw

8.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 13, 2026 - 19:58 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 17:16 nvd

HIGH 8.4

DescriptionGitHub Advisory

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.

AnalysisAI

High severity vulnerability in TinaCMS. The TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory.

Technical ContextAI

Vulnerability Type: Path Traversal (CWE-22) CVSS 3.1: 8.4/10.0 — Attack Vector: Local | Complexity: Low | Privileges Required: None | User Interaction: None Attack Techniques: Path Traversal, Rce Source: https://github.com/tinacms/tinacms Path traversal allows access to files outside the intended directory by manipulating file paths with sequences like '../'.