CVE-2026-28792: TinaCMS Path Traversal Vulnerability

CVE-2026-28792 Overview

A critical vulnerability has been identified in TinaCMS, a headless content management system, affecting versions prior to 2.1.8. The vulnerability combines a permissive CORS (Cross-Origin Resource Sharing) configuration with a path traversal flaw in the TinaCMS CLI dev server, enabling browser-based drive-by attacks against developers.

Critical Impact

Remote attackers can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer machines by tricking them into visiting a malicious website while tinacms dev is running.

Affected Products

• TinaCMS versions prior to 2.1.8
• TinaCMS CLI dev server with permissive CORS configuration
• Development environments running tinacms dev command

Discovery Timeline

• 2026-03-12 - CVE-2026-28792 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-28792

Vulnerability Analysis

This vulnerability stems from a dangerous combination of two security weaknesses in the TinaCMS CLI development server. The server implements an overly permissive CORS policy using Access-Control-Allow-Origin: *, which allows any website to make cross-origin requests to the local development server. When combined with a pre-existing path traversal vulnerability, this creates a severe attack surface.

The path traversal component (CWE-22) allows attackers to escape the intended directory structure and access arbitrary locations on the filesystem. The permissive CORS configuration removes the browser's same-origin policy protection, enabling malicious websites to interact with the local TinaCMS dev server running on a developer's machine.

This attack chain is particularly dangerous because it requires no direct network access to the victim's machine—the attacker only needs to lure the developer to a malicious webpage while the TinaCMS development server is active. The browser itself becomes the attack vector, executing requests to localhost on behalf of the malicious site.

Root Cause

The root cause is twofold: First, the TinaCMS CLI dev server implements Access-Control-Allow-Origin: * which permits any external origin to make requests to the local server. Second, insufficient input validation on file path parameters allows directory traversal sequences (such as ../) to escape the intended working directory. Together, these flaws enable cross-origin attacks that can manipulate the local filesystem.

Attack Vector

The attack leverages network-based delivery through a malicious website. When a developer visits an attacker-controlled webpage while running tinacms dev, the malicious site can issue JavaScript-based HTTP requests to the local development server. Due to the permissive CORS header, these requests succeed, and the path traversal vulnerability allows the attacker to:

1. Enumerate files and directories across the entire filesystem
2. Write arbitrary content to any accessible location
3. Delete files from the developer's machine

This constitutes a drive-by attack that requires only user interaction of visiting a webpage—no additional clicks or downloads are necessary.

Detection Methods for CVE-2026-28792

Indicators of Compromise

• Unexpected HTTP requests to local TinaCMS dev server from external origins
• Browser network activity showing cross-origin requests to localhost or 127.0.0.1 on the TinaCMS dev port
• Unusual file modifications, deletions, or new files appearing outside the TinaCMS project directory
• Web server logs showing requests with path traversal patterns (e.g., ../, ..%2f)

Detection Strategies

• Monitor development environments for TinaCMS versions older than 2.1.8
• Implement network monitoring to detect cross-origin requests targeting localhost services
• Use endpoint detection tools to alert on unexpected filesystem operations during development sessions
• Review browser developer tools for suspicious network activity when visiting external websites

Monitoring Recommendations

• Enable verbose logging in development environments to track incoming requests to local servers
• Implement file integrity monitoring on critical system directories during development activities
• Use browser extensions or policies that limit cross-origin request capabilities to localhost
• Consider network segmentation or firewall rules to restrict external access to development server ports

How to Mitigate CVE-2026-28792

Immediate Actions Required

• Upgrade TinaCMS to version 2.1.8 or later immediately
• Stop any running instances of tinacms dev on vulnerable versions until patched
• Audit development machines for any unauthorized file modifications or deletions
• Review recently visited websites for potential exposure while running the vulnerable dev server

Patch Information

TinaCMS has addressed this vulnerability in version 2.1.8. The fix reportedly removes the overly permissive CORS configuration and addresses the underlying path traversal vulnerability. Developers should update their TinaCMS installation to the patched version using their package manager. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Avoid running tinacms dev while browsing untrusted websites
• Use browser profiles or containers to isolate development browsing from general web browsing
• Implement local firewall rules to restrict incoming connections to the TinaCMS dev server port
• Consider running development servers in isolated virtual machines or containers

# Update TinaCMS to patched version
npm update tinacms@2.1.8

# Or using yarn
yarn upgrade tinacms@2.1.8

# Verify installed version
npm list tinacms