CVE-2026-63123

Name of the Vulnerable Software and Affected Versions TinaCMS versions prior to 2.5.2

Description The TinaCMS CLI package's Vite dev server contains a flaw where the origin callback in packages/@tinacms/cli/src/next/vite/cors.ts returns false for disallowed origins but fails to reject the request. Additionally, packages/@tinacms/cli/src/next/vite/plugins.ts continues to route the 'POST /media/upload/*' endpoint to mediaRouter.handlePost(). This allows the upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts to write attacker-controlled multipart contents into the configured media root. A remote attacker can exploit this by inducing a developer to visit a malicious page while the dev server is running, causing the browser to submit a state-changing request.

Recommendations Update to version 2.5.2.