A path traversal vulnerability exists in the TinaCMS CLI development server. The server exposes media endpoints (/media/list/*, /media/upload/*, /media/*) that process user-controlled path segments with decodeURI() and path.join() without verifying that the resolved path remains within the configured media directory. As a result, an attacker can read, modify, or delete any file on the filesystem that the server process can access, potentially exposing sensitive data or tampering with system configuration. The vulnerability is considered a high severity exploit (CVSS 8.4) due to the breadth of impact it allows.

The vulnerability affects the @tinacms:cli product. Any installation of the TinaCMS CLI older than version 2.1.8 is susceptible. The issue was resolved in update 2.1.8. Those using earlier releases should identify the affected installation and plan an upgrade.

The CVSS score indicates high potential impact, but the EPSS score is below 1%, suggesting exploitation is currently rare. The issue is not listed in the CISA KEV catalog. The attacker requires network access to the local HTTP server started by the CLI on port 4001; if the dev server is bound to localhost, the attack vector is primarily local. Exposure of the dev server to a network could elevate the threat but still requires the attacker to control or intercept traffic to that port.