CVE-2026-28792 Details
Description
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.
A vulnerability in the TinaCMS CLI development server prior to version 2.1.8 allows for cross-origin file exfiltration. This issue arises from a permissive Cross-Origin Resource Sharing (CORS) configuration that accepts requests from any origin, combined with a path traversal vulnerability. When both vulnerabilities are exploited, a remote attacker can manipulate a victim's browser to access the local filesystem of a developer running the TinaCMS dev server. The attacker can enumerate files, read sensitive information, and write or delete arbitrary files on the developer's machine.
Users should update TinaCMS to version 2.1.8 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinacms/tinacms/security/advisories/GHSA-8pw3-9m7f-q734 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/tinacms/tinacms/security/advisories/GHSA-8pw3-9m7f-q734 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ssw tinacms/cli | < 2.1.8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Mar 12, 2026 | New CVE Received | [email protected] |