CVE-2026-59992: CVE-2026-59992: Broken Access Control and Path Traversal in Tina CMS Production Media Adapters

#security #cve #cybersecurity

CVE-2026-59992: Broken Access Control and Path Traversal in Tina CMS Production Media Adapters

Vulnerability ID: CVE-2026-59992
CVSS Score: 5.4
Published: 2026-08-19

CVE-2026-59992 is a critical broken access control vulnerability in the first-party production media adapters of Tina CMS, including next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, and next-tinacms-cloudinary. The issue allows authenticated editors to escape the configured mediaRoot directory containment, facilitating unauthorized file uploads, modifications, and deletions across the entire storage bucket or container.

TL;DR

A broken access control flaw in Tina CMS media adapters allows authenticated editors to bypass directory containment and write or delete files globally across the connected cloud storage container using path traversal.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-639 / CWE-862
Attack Vector: Network (AV:N)
CVSS Score: 5.4 (Medium)
Exploit Status: poc
KEV Status: Not Listed
Impact: Unauthorized Write/Delete (Integrity & Availability)

Affected Systems

Tina CMS
next-tinacms-s3
next-tinacms-dos
next-tinacms-azure
next-tinacms-cloudinary
next-tinacms-s3: < 23.0.4 (Fixed in: 23.0.4)
next-tinacms-dos: < 23.0.4 (Fixed in: 23.0.4)
next-tinacms-azure: < 14.0.4 (Fixed in: 14.0.4)
next-tinacms-cloudinary: < 26.0.4 (Fixed in: 26.0.4)

Code Analysis

Commit: d44558e

Fix broken access control in media handlers by implementing media-key.ts resolver

@@ -66,15 +67,28 @@ export const createMediaHandler = (config: S3Config, options?: S3Options) => {
     switch (req.method) {
       case 'GET':
         if (req.query.key) {
-          const expiresIn: number =
-            (req.query.expiresIn && Number(req.query.expiresIn)) || 3600;
-          const s3_key = req.query.key
-            ? Array.isArray(req.query.key)
-              ? req.query.key[0]
-              : req.query.key
-            : null;
-          if (!s3_key) {
-            return res.status(400).json({ message: 'key is required' });
+          const requestedExpiresIn = Number(req.query.expiresIn);
+          const expiresIn =
+            Number.isFinite(requestedExpiresIn) && requestedExpiresIn > 0
+              ? Math.min(requestedExpiresIn, 3600)
+              : 3600;
+          const rawKey = Array.isArray(req.query.key)
+            ? req.query.key[0]
+            : req.query.key;
+          let s3_key: string;
+          try {
+            s3_key = resolveKey(mediaRoot, rawKey, { decode: false });
+          } catch (e) {
+            if (e instanceof MediaKeyError) {
+              return res.status(400).json({ message: e.message });
+            }
+            throw e;
+          }

Exploit Details

GitHub Security Advisory: Exploit concepts and root cause outlined in the official advisory.

Mitigation Strategies

Upgrade all affected Tina CMS adapter packages to the patched versions immediately.
Restrict IAM and bucket policy permissions for the CMS credentials to the specific mediaRoot directory at the cloud provider level.
Implement Web Application Firewall (WAF) rules to block path traversal payloads in request queries targeting media handler endpoints.

Remediation Steps:

Identify which media adapters are used in your Tina CMS project (e.g., next-tinacms-s3, next-tinacms-azure).
Update your package.json dependencies to specify patched versions: next-tinacms-s3 >= 23.0.4, next-tinacms-dos >= 23.0.4, next-tinacms-azure >= 14.0.4, next-tinacms-cloudinary >= 26.0.4.
Run your package manager install command (e.g., npm install or yarn install) to pull the updated versions.
Review cloud storage IAM permissions and modify policies to limit write and delete access specifically to the designated folder prefix.

References

Read the full report for CVE-2026-59992 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community