CVE-2026-63123

Received Received - Intake

Origin Validation Bypass and Arbitrary File Upload in TinaCMS

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-63123

Affected Vendors & Products

Vendor	Product	Version / Range
tinacms	cli	2.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

TinaCMS versions before 2.5.2 have a vulnerability where the Vite dev server's CORS origin callback incorrectly allows disallowed origins without rejecting requests. The media upload endpoint still processes POST requests to /media/upload/*, and the server writes attacker-controlled multipart content directly into the media root directory. This allows a remote attacker to trick a developer into uploading malicious files by visiting a malicious page while the dev server is running.

Detection Guidance

This vulnerability involves improper CORS handling and file upload routing in TinaCMS versions prior to 2.5.2. To detect it, check if your system runs an affected version by inspecting package.json or running npm list @tinacms/cli. Monitor browser console logs for CORS errors when accessing the dev server. Look for unexpected POST requests to /media/upload/* endpoints.

Impact Analysis

If you use an affected TinaCMS version, an attacker could upload malicious files to your media directory, potentially leading to remote code execution, data theft, or defacement of your site. This could compromise your development environment or deployed application if the media directory is web-accessible.

Compliance Impact

This vulnerability could lead to unauthorized file uploads, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. If sensitive data is exposed or altered due to malicious uploads, it may result in compliance violations and legal consequences.

Mitigation Strategies

Upgrade TinaCMS CLI to version 2.5.2 or later immediately. If upgrading is not possible, disable the dev server or restrict access to it. Avoid running the dev server on public networks. Review media upload directories for unauthorized files and revoke any suspicious access.

Hi! I’m here to help you understand CVE-2026-63123. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70