CVE-2026-28793 - Vulnerability Analysis

Overview

TinaCMS CLI development server < 2.1.8 contains a path traversal caused by improper validation of user-controlled path segments in media endpoints, letting attackers read and write arbitrary files outside the media directory, exploit requires running tinacms dev.

Severity & Score

Impact

Attackers can read and write arbitrary files on the filesystem, potentially leading to full system compromise.

Mitigation

Upgrade to version 2.1.8 or later.

References

• https://github.com/tinacms/tinacms/security/advisories/GHSA-2f24-mg4x-534q

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 12, 2026

🟠 CVE-2026-28793 - High (8.4) Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the inte... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28793/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner