CVE-2026-59992

Received Received - Intake

Path Traversal in Tina CMS Media Adapters

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without enforcing the operator's configured mediaRoot. In packages/next-tinacms-s3/src/handlers.ts, createMediaHandler accepts req.query.key for a signed PutObject URL and the DELETE path uses req.query.media as the DeleteObjectCommand key. The same missing key-boundary check exists in packages/next-tinacms-dos/src/handlers.ts, packages/next-tinacms-azure/src/handlers.ts, and packages/next-tinacms-cloudinary/src/handlers.ts. An authenticated CMS editor can therefore create or delete objects anywhere the deployment's storage credential can reach, including other tenants' or non-media objects. These issues are fixed in next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-59992

Affected Vendors & Products

Vendor	Product	Version / Range
next-tinacms	next-tinacms-s3	to 23.0.4 (exc)
next-tinacms	next-tinacms-dos	to 23.0.4 (exc)
next-tinacms	next-tinacms-azure	to 14.0.4 (exc)
next-tinacms	next-tinacms-cloudinary	to 26.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Tina, a headless content management system. It involves media adapters in next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, and next-tinacms-cloudinary versions before 23.0.4, 23.0.4, 14.0.4, and 26.0.4 respectively. Attackers with CMS editor access can manipulate object keys to upload or delete files anywhere the storage credentials allow, including other tenants' data or non-media objects.

Impact Analysis

An authenticated CMS editor could delete or overwrite critical files, including other users' data or system files. This could lead to data loss, unauthorized modifications, or service disruption. The impact depends on the storage credentials' permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality requirements or HIPAA's access controls. Organizations using affected versions may face compliance violations and potential fines.

Mitigation Strategies

Update affected packages to fixed versions: next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, or next-tinacms-cloudinary 26.0.4. Review storage credentials and access controls to limit potential damage from unauthorized operations.

Hi! I’m here to help you understand CVE-2026-59992. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70