CVE-2026-59992

Name of the Vulnerable Software and Affected Versions next-tinacms-s3 versions prior to 23.0.4 next-tinacms-dos versions prior to 23.0.4 next-tinacms-azure versions prior to 14.0.4 next-tinacms-cloudinary versions prior to 26.0.4

Description First-party production media adapters in this headless content management system fail to enforce the configured mediaRoot when passing object keys to storage SDK upload and delete operations. In the createMediaHandler function, the system accepts req.query.key for signed PutObject URLs, and the DELETE path utilizes req.query.media as the DeleteObjectCommand key. This missing key-boundary check allows an authenticated CMS editor to create or delete objects across any location accessible by the deployment's storage credentials, potentially affecting other tenants or non-media objects.

Recommendations Update next-tinacms-s3 to version 23.0.4 or later. Update next-tinacms-dos to version 23.0.4 or later. Update next-tinacms-azure to version 14.0.4 or later. Update next-tinacms-cloudinary to version 26.0.4 or later.