An authenticated editor in TinaCMS can use the production media adapters to send requests that include any object key to the underlying storage SDK. Because the adapters do not enforce the configured mediaRoot boundary, the editor can create or delete objects anywhere the deployment’s storage credentials can reach, including non‑media files and objects belonging to other tenants.

Vulnerable components are the production media adapters in TinaCMS: next‑tinacms‑s3, next‑tinacms‑dos, next‑tinacms‑azure, and next‑tinacms‑cloudinary. For next‑tinacms‑s3 the affected releases are earlier than 23.0.4, for next‑tinacms‑dos earlier than 23.0.4, for next‑tinacms‑azure earlier than 14.0.4, and for next‑tinacms‑cloudinary earlier than 26.0.4.

With a CVSS score of 5.4, the vulnerability poses moderate severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. The vulnerability requires an authenticated editor role and a reachable storage credential; once those conditions are met, an attacker can issue signed PutObject or DeleteObject commands to arbitrary keys, potentially leading to data loss or exposure. Attack vectors are through the CMS editor interface or programmatic API endpoints that expose the key parameter, and no special network access beyond the CMS application is required.