TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
Date: 2026-03
Affected: npm/@tinacms/cli
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-28792
CWE: CWE-22
CWE-942
CVSS: 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

## Summary The TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. ## Details The TinaCMS dev server sets permissive CORS headers that allow **any origin** to make cross-origin requests: - packages/@tinacms/cli/src/server/server.ts: ``` app.use(cors()); ``` - packages/@tinacms/cli/src/next/vite/plugins.ts: ``` server.middlewares.use(cors()); ``` When combined with the path traversal vulnerability, this creates a complete attack chain. ## Attack Scenario ### Prerequisites 1. Developer runs `tinacms dev` (default port 4001) 2. Developer visits attacker's website while TinaCMS is running **No other conditions required** - the dev server doesn't need to be: - Exposed to the internet - Bound to 0.0.0.0 - Accessible outside localhost ### Attack Flow 1. Developer starts TinaCMS: `tinacms dev` 2. Developer browses the web (checking email, social media, etc.) 3. Developer unknowingly visits attacker-controlled page (malicious ad, compromised site, etc.) 4. Attacker's JavaScript exploits CORS + path traversal to read sensitive files 5. Files are exfiltrated to attacker's server ## PoC ### Attacker's Malicious Website (e


Mitigations:

Architectural layers (MAESTRO):