CVE-2026-63123
MediumCVSS 6.5Summary
TinaCMS before version 2.5.2 has a vulnerability in the Vite dev server where the server does not reject requests from disallowed origins and still routes POST /media/upload/* to the media handler. A remote attacker can cause a developer's browser to submit a state-changing request, allowing attacker-controlled content to be written inside the media root.
Risk Assessment
An attacker can write malicious files into the development system, potentially leading to compromise of the application or code execution in the developer's context.
Recommendation
Upgrade TinaCMS to version 2.5.2 or later, which includes the fix.
Original NVD description (English source)
Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2.