CVE-2026-28793

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.

• CWE-22

• https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534qExploit, Vendor Advisory
• https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534qExploit, Vendor Advisory

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28788Open WebUI is a self-hosted artificial intelligence platform…7.1
• CVE-2026-28789OliveTin gives access to predefined shell commands from a we…7.5
• CVE-2026-2879The GetGenie plugin for WordPress is vulnerable to Insecure …5.4
• CVE-2026-28790OliveTin gives access to predefined shell commands from a we…7.5
• CVE-2026-28791Tina is a headless content management system. Prior to 2.1.7…7.4
• CVE-2026-28792Tina is a headless content management system. Prior to 2.1.8…9.6
• CVE-2026-28794oRPC is an tool that helps build APIs that are end-to-end ty…9.8
• CVE-2026-28795OpenChatBI is an intelligent chat-based BI tool powered by l…9.8
• CVE-2026-28797RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…8.8
• CVE-2026-28798ZimaOS is a fork of CasaOS, an operating system for Zima dev…10
• CVE-2026-28799PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2026-2880A vulnerability in @fastify/middie versions < 9.2.0 can resu…9.1