CVE-2026-63123 in TinaCMS
Summary
by MITRE • 08/20/2026
Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in TinaCMS versions prior to 2.5.2 stems from a critical misconfiguration within its development server, specifically involving the Cross-Origin Resource Sharing (CORS) mechanism and file upload handling logic. As a headless content management system designed for developer workflows, TinaCMS relies on a local development environment that facilitates rapid iteration. However, the implementation of security controls in this mode was insufficient to prevent unauthorized state-changing actions from external sources. The core technical flaw resides in two distinct components: the CORS origin validation callback and the media upload routing logic within the Vite dev server packages.
In the file located at packages/@tinacms/cli/src/next/vite/cors.ts, the system implements a check to determine if an incoming request's Origin header matches allowed origins. While this function correctly returns false when it encounters a disallowed origin, indicating that the origin is not trusted, it fails to enforce this decision by rejecting or blocking the HTTP request. Instead of terminating the connection with an appropriate error response such as 403 Forbidden, the server proceeds to process the request further downstream. This behavior effectively nullifies the purpose of CORS validation in preventing cross-site attacks because the browser's same-origin policy relies on the server explicitly denying requests from untrusted origins via specific HTTP status codes and headers. By allowing the request through despite a negative origin check, the application exposes itself to Cross-Site Request Forgery (CSRF) vectors where an attacker can trick a victim into making unintended requests.
Compounding this issue is the routing configuration found in packages/tinacms/cli/src/next/vite/plugins.ts. This module continues to route POST requests targeting paths matching /media/upload/* directly to mediaRouter.handlePost, regardless of whether the CORS check previously failed or passed. The subsequent handler, located in packages/tinacms/cli/src/next/commands/dev-command/server/media.ts, processes these multipart form data uploads by writing the content into a directory defined as the configured media root on the developer's local file system. Because this operation is state-changing and involves writing files to disk, it represents a significant security risk if accessible from untrusted origins. The combination of bypassing origin validation and allowing unrestricted file writes creates a pathway for remote code execution or server-side request forgery depending on how the uploaded content is later processed by other parts of the application stack.
The operational impact of this vulnerability allows a remote attacker to perform Cross-Site Request Forgery attacks against developers running the TinaCMS development server. An attacker can craft a malicious webpage that, when visited by an authenticated developer with an active dev session, automatically submits multipart form data containing arbitrary files or payloads to the local media upload endpoint. Since modern browsers typically include credentials such as cookies in cross-origin requests if configured appropriately, and given that this is a localhost development environment where users often have elevated trust settings, the attack can succeed without explicit user interaction beyond visiting the malicious page. This could lead to unauthorized file uploads, potential directory traversal issues if path validation is also weak, or further exploitation through uploaded scripts if they are served back by subsequent application logic.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), as it involves inducing a user to submit state-changing requests without their consent. Additionally, the failure to properly validate and reject cross-origin requests relates to CWE-942, or Permissive Cross-Origin Policy in Web Applications, specifically regarding the improper enforcement of CORS rules. From an ATT&CK perspective, this falls under T1566.002, Spearphishing Link, as it relies on social engineering techniques where a victim is induced to visit a controlled page that triggers the exploit automatically. The lack of proper CSRF tokens or strict origin rejection mechanisms are typical indicators of such weaknesses in web application frameworks during development modes.
To mitigate this vulnerability and secure similar environments, developers must ensure they upgrade TinaCMS to version 2.5.2 or later where these issues have been addressed. For organizations managing their own instances before upgrading, it is crucial to implement strict CORS policies that explicitly reject requests with mismatched origins by returning a 403 status code rather than merely logging the event or ignoring it. Furthermore, implementing anti-CSRF tokens in all state-changing API endpoints provides an additional layer of defense against unauthorized submissions. In development environments specifically, restricting access to localhost-only connections and ensuring that sensitive operations require explicit user interaction can significantly reduce the attack surface. Regular security audits focusing on authentication bypasses and input validation for file uploads are essential practices to maintain integrity in content management systems.