Next Tinacms Cloudinary
Monthly
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) allows any authenticated CMS editor to write or delete storage objects outside the operator-configured mediaRoot boundary. The handlers pass attacker-controlled query parameters (req.query.key for presigned S3 PUTs, req.query.media for DELETEs) directly to storage SDK operations without validating that the resulting key falls within the permitted path prefix, giving editors write and delete authority over the entire storage bucket or container reachable by the deployment's IAM or service credential. Vendor-released patches exist in all four packages; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) allows any authenticated CMS editor to write or delete storage objects outside the operator-configured mediaRoot boundary. The handlers pass attacker-controlled query parameters (req.query.key for presigned S3 PUTs, req.query.media for DELETEs) directly to storage SDK operations without validating that the resulting key falls within the permitted path prefix, giving editors write and delete authority over the entire storage bucket or container reachable by the deployment's IAM or service credential. Vendor-released patches exist in all four packages; no public exploit or CISA KEV listing has been identified at time of analysis.