CVE-2026-28791 json
Path Traversal in Media Upload Handle in Tina
published 2026-03-12 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-11609 , GHSA-5hxf-c7j4-279c
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. The code at media.ts joins user-controlled path segments using path.join() without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem. This vulnerability is fixed in 2.1.7.
Patch / fix
- npm tinacms 2.1.7
- tina tinacms 2.1.7
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/tinacms/tinacms/security/advisories/GHSA-5hxf-c7j4-279c referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | tinacms | <2.1.7 |
2.1.7 |
Affected products
- tinacms tinacms
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/tinacms/tinacms/security/advisories/GHSA-5hxf-c7j4-279c
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-28791
advisory
-
github.com
/tinacms/tinacms
package
Sources
- CVE List CVE-2026-28791
- GitHub Advisory GHSA-5hxf-c7j4-279c
- NVD CVE-2026-28791
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.