CVE-2026-63123: TinaCMS CSRF Vulnerability

CVE-2026-63123 Overview

CVE-2026-63123 is a Cross-Site Request Forgery (CSRF) vulnerability in TinaCMS, a headless content management system. The flaw affects the @tinacms/cli package's Vite development server prior to version 2.5.2. The CORS origin callback in packages/@tinacms/cli/src/next/vite/cors.ts returns false for disallowed origins but does not reject the request. As a result, POST /media/upload/* requests continue to reach mediaRouter.handlePost, allowing attacker-controlled multipart content to be written inside the configured media root. This vulnerability is tracked as [CWE-352].

Critical Impact
A remote attacker can write arbitrary files into a developer's local media directory by luring them to an attacker-controlled web page while tinacms dev is running.

Affected Products

TinaCMS CLI package (@tinacms/cli) prior to version 2.5.2
Developer workstations running tinacms dev
Vite development server integration shipped with TinaCMS

Discovery Timeline

2026-08-19 - CVE CVE-2026-63123 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-63123

Vulnerability Analysis

The TinaCMS CLI ships a Vite-based development server that exposes an authenticated media upload endpoint at POST /media/upload/*. The server relies on a CORS origin callback to gate cross-origin browsers. The callback in packages/@tinacms/cli/src/next/vite/cors.ts signals disallowed origins by passing false to the cors middleware. That signal only suppresses CORS response headers. It does not terminate the underlying request.

Because packages/@tinacms/cli/src/next/vite/plugins.ts continues to route the POST body to mediaRouter.handlePost, the upload handler in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts still parses and writes the multipart payload. The result is a state-changing request that executes without a same-origin check.

Root Cause

The root cause is a misuse of the cors package's origin callback as an authorization gate. Returning false disables CORS headers but does not reject the HTTP request. Combined with the absence of CSRF tokens and permissive routing, the endpoint accepts writes from any origin the browser is willing to submit.

Attack Vector

An attacker hosts a malicious page that submits a cross-origin POST request with a multipart/form-data body to http://localhost:<port>/media/upload/<path>. When a developer running tinacms dev visits the page, the browser submits the request with the developer's context. The upload handler writes the attacker-controlled file into the configured media root, enabling content tampering or staging of malicious assets served by the developer's local site.

typescript

// Security patch in packages/@tinacms/cli/src/next/vite/cors.ts
// Reject cross-origin state-changing requests on the dev server (#7111)

/**
 * Decide whether a request `Origin` is allowed to reach the dev server.
 *
 * No `Origin` (curl, same-origin, CLI tooling) and localhost are always
 * allowed; extra `allowedOrigins` (with `'private'` expanded) match by exact
 * string or RegExp.
 */
export function isOriginAllowed(
  origin: string | undefined,
  allowedOrigins: (string | RegExp)[] = []
): boolean {
  // Allow requests with no Origin header (curl, same-origin, etc.).
  if (!origin) {
    return true;
  }
  if (LOCALHOST_RE.test(origin)) {
    return true;
  }
  for (const allowed of expandOrigins(allowedOrigins)) {
    if (typeof allowed === 'string') {
      if (allowed === origin) {
        return true;
      }
    } else {
      allowed.lastIndex = 0;
      if (allowed.test(origin)) {
        return true;
      }
    }
  }
  return false;
}

Source: TinaCMS commit 211997c

The patch introduces an explicit isOriginAllowed check that is enforced before the request reaches mediaRouter.handlePost, ensuring disallowed origins are rejected outright.

Detection Methods for CVE-2026-63123

Indicators of Compromise

Unexpected files appearing under the TinaCMS configured media root on developer workstations.
HTTP access logs on the local Vite dev server showing POST /media/upload/* requests with an Origin header from an unknown external domain.
Recent browser history entries to unfamiliar sites while tinacms dev was running.

Detection Strategies

Inspect the @tinacms/cli version declared in package.json and package-lock.json across developer repositories; flag any version below 2.5.2.
Audit git history in TinaCMS media directories for unattributed commits containing binary or image assets.
Review endpoint telemetry for node processes bound to Vite dev ports receiving cross-origin POSTs.

Monitoring Recommendations

Enable browser network logging on developer machines and alert on cross-origin POSTs to localhost endpoints associated with tinacms dev.
Track outbound developer web traffic against threat intelligence feeds to identify visits to newly registered or suspicious domains.
Monitor file system changes within TinaCMS media roots and integrate the events into the SOC pipeline.

How to Mitigate CVE-2026-63123

Immediate Actions Required

Upgrade @tinacms/cli to version 2.5.2 or later in every project that uses TinaCMS.
Stop any running tinacms dev sessions on unpatched versions until the upgrade is complete.
Review the media root for unauthorized files introduced during the exposure window and remove them.

Patch Information

The fix is available in @tinacms/cli version 2.5.2. It adds an isOriginAllowed function and enforces the origin check before requests reach the media upload handler. Refer to the TinaCMS security advisory GHSA-rgr9-r7mj-mf6x, the pull request #7111, and the release notes for @tinacms/cli 2.5.2 for full details.

Workarounds

Run tinacms dev only inside an isolated browser profile that is not used for general web browsing.
Bind the Vite dev server to 127.0.0.1 and block external inbound traffic with a host firewall rule.
Close all other browser tabs and avoid untrusted links while the TinaCMS dev server is running on unpatched versions.

bash

# Configuration example - upgrade the TinaCMS CLI to the patched release
npm install --save-dev @tinacms/cli@2.5.2

# Verify the installed version
npx @tinacms/cli --version