CVE-2026-63123

{
  "id": "CVE-2026-63123",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T22:16:58.710",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2."
    },
    {
      "lang": "es",
      "value": "Tina es un sistema de gestión de contenido sin interfaz gráfica (headless). Antes de la versión 2.5.2, la devolución de llamada de origen (origin callback) del archivo packages/@tinacms/cli/src/next/vite/cors.ts del servidor de desarrollo Vite del paquete TinaCMS CLI devuelve ’false’ para un origen no permitido, pero no rechaza la solicitud, y packages/@tinacms/cli/src/next/vite/plugins.ts aún enruta POST /media/upload/* a mediaRouter.handlePost. El código de carga en packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts escribe contenido multipart controlado por el atacante dentro de la raíz de medios configurada. Un atacante remoto puede hacer que el navegador de un desarrollador envíe esta solicitud que cambia el estado al inducir al desarrollador a visitar una página controlada por el atacante mientras tinacms dev está en ejecución. Este problema se solucionó en la versión 2.5.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "tinacms",
          "product": "tinacms",
          "versions": [
            {
              "version": "< 2.5.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-25T14:19:26.459504Z",
          "id": "CVE-2026-63123",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/tinacms/tinacms/commit/211997cdb53cbd43638bdee999faa65375cfc260",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tinacms/tinacms/pull/7111",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected]",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}