THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-rgr9-r7mj-mf6x (medium) — Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

[GHSA] GHSA-rgr9-r7mj-mf6x (medium) — Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

highgithub_advisoriesPublished 2026-08-19

GHSA-rgr9-r7mj-mf6x Severity: medium CVE: CVE-2026-63123

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

### Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running `tin

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-63123cve
http://127.0.0.1:url
http://evil.test:8000`url

Original source: https://github.com/advisories/GHSA-rgr9-r7mj-mf6x