Path Traversal in the media upload handler of Tina CMS allows an attacker to write files to arbitrary locations on the server’s filesystem. The vulnerability arises because the development server concatenates user-controlled path segments with path.join() without checking that the resolved path remains inside the designated media directory. Writing files outside the intended directory can overwrite critical system files or place malicious scripts, potentially leading to remote code execution or other severe compromise. This weakness corresponds to CWE‑22.

The vulnerability affects the Tina CMS development server in the tinacms:tinacms product. All releases before version 2.1.7 contain the flaw. No other versions or products are listed as affected.

The CVSS score of 7.4 indicates high severity. The EPSS score is below 1 %, suggesting that exploitation is currently unlikely, and the issue is not listed in the CISA KEV registry. The likely attack vector is the media upload endpoint exposed by the development server; this inference is based on the description that the flaw exists in the dev server's media upload handler. Because file uploads are part of the normal functionality, an attacker with network access to the server could potentially abuse it, but this would require privileged write access to the server’s filesystem.