CyberRota Analysis
AI-GeneratedThe TinaCMS CLI package prior to version 2.5.2 is vulnerable to a security flaw that allows remote attackers to exploit the Vite dev server's handling of CORS, enabling unauthorized file uploads to the media root. This vulnerability can be exploited by tricking a developer into visiting a malicious page while the development server is running, potentially leading to unauthorized state changes in the application. Organizations using TinaCMS for development should prioritize upgrading to version 2.5.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2.