CVE-2026-28792: TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
The TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer’s machines by simply tricking them into visiting a malicious website while tinacms dev is running.
References
- github.com/advisories/GHSA-8pw3-9m7f-q734
- github.com/tinacms/tinacms
- github.com/tinacms/tinacms/commit/56d533e610a520ba66b3e58f3a0dc03487d5d5d7
- github.com/tinacms/tinacms/pull/6450
- github.com/tinacms/tinacms/releases/tag/%40tinacms%2Fcli%402.1.8
- github.com/tinacms/tinacms/security/advisories/GHSA-8pw3-9m7f-q734
- nvd.nist.gov/vuln/detail/CVE-2026-28792
Code Behaviors & Features
Detect and mitigate CVE-2026-28792 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →