CVE-2026-28791CWE-22

Path Traversal in Media Upload Handle in Tina

High · published March 12, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. The code at media.ts joins user-controlled path segments using path.join() without validating that the resulting path stays within the intended media directory. This allows writing files to arbitrary locations on the filesystem. This vulnerability is fixed in 2.1.7.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00463 · 39.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-12T16:55Z
EPSS history
Timeline
  • 12 MAR 16:55Z
    Path Traversal in Media Upload Handle in Tina
    cvelistv5