Tina: Path Traversal in Media Upload Handle

Description

| Field | Value | |——-|——-| | Package | @tinacms/cli | | Version | 2.0.5 (latest at time of discovery) | | Vulnerable File | packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts | | Vulnerable Lines | 42-43 |

Recommendation

Update the tinacms package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.7
• Patched version(s): 2.1.7

References

• GHSA-5hxf-c7j4-279c
• CVE-2026-28791
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• @tinacms/graphql has a Path Traversal issue - CVE-2026-24125
• @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files - CVE-2026-33949
• Agnai vulnerable to Relative Path Traversal in Image Upload - CVE-2024-47171
• @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions - CVE-2026-34603

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

tinacms