Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28793 Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowi… https://www.cve.org/CVERecord?id=CVE-2026-28793
Post summary
CVE-2026-28793 impacts TinaCMS CLI versions before 2.1.8, exposing a path traversal flaw in its media endpoints.
🔴 TinaCMS CLI, Path Traversal, #CVE-2026-28793 (High) https://dailycve.com/tinacms-cli-path-traversal-cve-2026-28793-high/
Post summary
A high‑severity path traversal vulnerability (CVE‑2026‑28793) has been disclosed for TinaCMS CLI.
🟠 CVE-2026-28793 - High Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and ... https://www.thehackerwire.com/vulnerability/CVE-2026-28793/ https://t.co/4Q1sQGLY45
Post summary
The tweet announces a high‑severity path‑traversal flaw in TinaCMS CLI (v<2.1.8) with limited technical detail; no PoC, exploit, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ssw | tinacms\/cli | - | node.js | - |