TinaCMS’s Vite development server contains a CSRF vulnerability: the origin callback in the cors module returns false for disallowed origins but does not reject the request, allowing cross‑origin POST /media/upload/* traffic to reach the media router. When the upload handler receives multipart data, it writes the contents directly into the configured media root without authenticating or validating the origin. An attacker can cause a developer to visit a malicious page while the dev server is active, and the browser will automatically submit a POST request that creates arbitrary files in the media directory, potentially including malicious code. This is a classic cross‑scripting error reflected in CWE‑352.

All installations of the TinaCMS CLI (tinacms:tinacms) running the Vite dev server with the media upload feature and using a version earlier than 2.5.2. Any developer who starts the dev server locally and retains it online while browsing the internet is susceptible.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. EPSS data is unavailable, and it is not listed in CISA’s KEV catalog. Exploitation requires social engineering: the attacker must first persuade a developer to visit a malicious page while the dev server is running. Once the precondition is satisfied, the attacker can issue a cross‑origin POST that the server blindly processes, creating arbitrary files. The lack of authentication or input validation in the upload routine makes the attack straightforward for an attacker with the ability to influence the developer’s browser.