Critical CORS + Path Traversal in TinaCMS CLI Dev Server

Executive Summary

CVE-2026-28792 is a critical remote file disclosure vulnerability in TinaCMS, a widely-used open-source headless content management system. The flaw exists in the TinaCMS CLI dev server and combines two weaknesses: a permissive CORS configuration (Access-Control-Allow-Origin: *) and a path traversal vulnerability that allows navigation outside the intended content directory.

CVSS Score: 9.6 (Critical)

Together, these flaws enable a browser-based drive-by attack: a developer visiting a malicious webpage while running the TinaCMS dev server can have arbitrary files read from their machine and exfiltrated to an attacker-controlled server — entirely without user interaction beyond loading the page.

This vulnerability is fixed in TinaCMS 2.1.8. Any developer running the TinaCMS CLI dev server on a prior version while browsing the web is at risk.

Vulnerability Overview

Affected Products

Technical Analysis

Component: TinaCMS CLI Dev Server

The TinaCMS CLI includes a local development server that developers run during content editing workflows. This server:

• Listens on localhost (typically http://localhost:4001)
• Serves the TinaCMS editing UI and backend GraphQL API
• Reads and writes MDX/markdown content files from the project directory

The dev server is intended exclusively for local development use. However, it exposes an HTTP interface on localhost that is accessible to any process or browser tab running on the same machine.

Flaw 1: Permissive CORS Configuration

The TinaCMS dev server sets Access-Control-Allow-Origin: * on all responses, including API endpoints that serve file content. This allows any webpage in any browser tab to make cross-origin requests to the locally running dev server and read the responses.

Under normal web security (the Same-Origin Policy), a malicious webpage at https://evil.example.com cannot read responses from http://localhost:4001. The Access-Control-Allow-Origin: * header explicitly bypasses this protection, granting every origin full read access to the dev server's API.

Flaw 2: Path Traversal

The TinaCMS dev server contains a path traversal vulnerability (previously reported) in its file-serving logic. Crafted requests using ../ sequences can escape the intended content directory and reach arbitrary locations on the filesystem — including:

• ~/.ssh/ (SSH private keys)
• ~/.aws/credentials (AWS access keys)
• .env files throughout the project tree
• /etc/passwd, /etc/hosts
• Browser stored credential databases
• Any file readable by the user running the dev server

The Combined Attack Chain

The two flaws combine into a zero-click drive-by attack requiring only that the victim visits a malicious webpage while their TinaCMS dev server is running:

Attack Chain:
1. Attacker creates a malicious webpage with embedded JavaScript
2. Developer visits the malicious page (phishing, typosquat, malvertising, etc.)
3. JavaScript fetches http://localhost:4001/api/../../.ssh/id_rsa
   → CORS: *  means the browser completes this cross-origin request
   → Path traversal: ../  sequences reach files outside content dir
4. Browser returns file content to the malicious webpage's JavaScript
5. JavaScript exfiltrates file content to attacker's server
6. Developer is unaware — no prompts, no visible indicators

Enumeration Capability

Attackers can enumerate file paths systematically using the same technique:

// Conceptual attack (for understanding only)
const targets = [
  '../../.ssh/id_rsa',
  '../../.ssh/id_ed25519',
  '../../.aws/credentials',
  '../../.env',
  '../../../.env',
  '../../.gitconfig'
];
// Each fetched cross-origin via CORS: * misconfiguration

This enables systematic credential harvesting across common developer secret storage locations.

Impact Assessment

Who Is at Risk

Any developer who:

1. Runs npx tinacms dev or tina dev (TinaCMS CLI dev server)
2. Uses a version of @tinacms/cli prior to 2.1.8
3. Browses the web in the same browser session — visiting any page could trigger the attack

High-risk developer profiles:

• Jamstack / Next.js developers using TinaCMS for content management
• Agency developers managing multiple TinaCMS-powered client sites
• Open-source contributors running TinaCMS locally against GitHub repositories

Immediate Remediation

Step 1: Upgrade TinaCMS CLI to 2.1.8+

# Check current version
npx @tinacms/cli --version
 
# Update via npm
npm install @tinacms/cli@latest
 
# Update via yarn
yarn upgrade @tinacms/cli
 
# Verify updated version
npx @tinacms/cli --version

Step 2: If Immediate Upgrade Is Not Possible

# Stop the TinaCMS dev server when not actively using it
# Use browser profiles — run TinaCMS dev work in a dedicated browser profile
# that is not used for general browsing
 
# Check if dev server is currently running
lsof -i :4001  # macOS/Linux
netstat -an | grep 4001  # Windows

Step 3: Audit for Prior Exposure

# Review shell history and server logs for unexpected connections to port 4001
# Check for unexpected processes that may have connected to the dev server
netstat -an | grep 4001
 
# Review SSH authorized_keys for unexpected entries (in case keys were compromised)
cat ~/.ssh/authorized_keys
 
# Rotate any secrets that may have been accessible via .env files while
# running a vulnerable TinaCMS version during web browsing

Step 4: Rotate Potentially Exposed Credentials

If you ran a vulnerable TinaCMS version while browsing untrusted sites, rotate:

• SSH private keys (generate new key pair, update all servers)
• AWS/GCP/Azure access keys
• API keys in .env files
• OAuth client secrets
• Database passwords

Detection Indicators

Developer Security Best Practices

1. Never run dev servers with wildcard CORS — bind to 127.0.0.1 only and use restrictive CORS
2. Use browser profiles — separate profile for local development vs. general browsing
3. Keep dev dependencies updated — patch dev tooling as promptly as production code
4. Store secrets in a secrets manager — avoid .env files with production credentials on dev machines
5. Audit localhost services — periodically review what ports are listening on your machine

References

• NVD — CVE-2026-28792
• TinaCMS GitHub Security Advisories
• TinaCMS Releases — 2.1.8

Related Reading

• GlassWorm Escalates: 72 Malicious Open VSX Extensions Use
• Trojanized MCP Server Deploys StealC Infostealer Targeting
• WinRAR Path Traversal Flaw CVE-2025-8088 Actively Exploited