Description

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:16:58.710Z",
  "pubdate": "2026-08-19T22:16:58.710Z",
  "executiveSummary": "A security vulnerability exists in the TinaCMS CLI package prior to version 2.5.2, specifically involving improper CORS origin validation and an unauthenticated state-changing media upload endpoint. The vulnerability enables a remote attacker to execute a Cross-Site Request Forgery (CSRF)-style attack against a developer running the local TinaCMS development server. By inducing the developer to visit a malicious, attacker-controlled web page, the attacker can force the victim's browser to dispatch a malicious cross-origin POST request containing arbitrary multipart payload contents. This request is successfully processed by the local Vite dev server due to flawed origin callback logic returning false without terminating the request, combined with exposed routing to media handling functions. Consequently, the application writes attacker-controlled data directly into the configured local media root directory. The impact includes potential arbitrary file write on the developer's host machine, which could lead to further code execution or repository tampering depending on the media root configuration and project structure. Exploitation requires the victim to interact with an external malicious web page while the local development server is active, targeting local network or localhost exposure.",
  "technicalDetails": "The vulnerability resides within the TinaCMS CLI package prior to version 2.5.2, affecting multiple internal modules responsible for Vite development server configuration, CORS handling, routing, and media management. Specifically, the root cause spans across packages/@tinacms/cli/src/next/vite/cors.ts, packages/@tinacms/cli/src/next/vite/plugins.ts, and packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts.\nIn packages/@tinacms/cli/src/next/vite/cors.ts, the custom origin callback implementation evaluates incoming cross-origin requests. When a disallowed origin is encountered, the callback returns false to indicate rejection; however, it fails to properly terminate or reject the underlying network request connection at the server framework level. Concurrently, packages/@tinacms/cli/src/next/vite/plugins.ts registers routing rules that actively map POST requests matching /media/upload/* directly to the mediaRouter.handlePost function, regardless of the anomalous CORS state.\nThe attack flow begins when a developer starts the local development environment using the tinacms dev command, exposing the Vite dev server locally. A remote attacker crafts a malicious external website containing automated JavaScript scripts designed to submit state-changing POST requests targeting the developer's localhost or local network instance of the TinaCMS dev server. When the developer navigates to the attacker-controlled page, their browser automatically dispatches the multipart/form-data request to the local server.\nBecause the CORS origin validation in cors.ts returns false without dropping the transaction, and the route remains exposed via plugins.ts, the request reaches mediaRouter.handlePost in media.ts. The media upload handler processes the multipart contents and writes the attacker-controlled payload directly inside the configured media root directory on the host filesystem. No authentication or elevated privileges are required beyond the developer executing the local development server and browsing the malicious web resource, leveraging the implicit trust relationship of the local network and browser context."
}