Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2026-28792 is a critical-severity Path Traversal (CWE-22) vulnerability in Ssw Tinacms\/Cli. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28792 is a high-severity vulnerability (CVSS 9.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) in the TinaCMS CLI dev server, part of Tina, a headless content management system. Versions prior to 2.1.8 combine a permissive CORS policy (Access-Control-Allow-Origin: *) with a path traversal flaw (CWE-22, CWE-942), enabling cross-origin requests that bypass typical browser security restrictions during local development.
A remote, unauthenticated attacker can exploit this via a drive-by browser attack by tricking a developer into visiting a malicious website while the "tinacms dev" server is running locally. This grants the attacker the ability to enumerate the developer's filesystem, write arbitrary files, and delete arbitrary files, potentially leading to full local compromise.
The GitHub security advisory (GHSA-8pw3-9m7f-q734) confirms the issue is resolved in TinaCMS 2.1.8, which practitioners should apply immediately to affected development environments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11611
Vulnerability Data
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can…
more
enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.3V3.4.6V5.3.2V3.5.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Information flow enforcement requires approved authorizations and would reject policies permitting untrusted domains.
Input validation directly neutralizes special path elements before pathname construction occurs.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Boundary protection at external interfaces stops unauthorized cross-domain communication allowed by permissive policies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.
Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.
Vulnerability identification processes can surface permissive policy misconfigurations.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.
Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.
Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.