{"id":"EUVD-2026-63102","revision":"612987bc4ffb4ff694b5e4f645b7297a","records":[{"revision":"612987bc4ffb4ff694b5e4f645b7297a","observedAt":"2026-11-03T12:02:01.926+00:00","statement":{"source":"euvd","id":"EUVD-2026-63102","aliases":["CVE-2026-59992","GHSA-8mq9-5fw2-5rm4"],"title":"Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object…","description":"Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without enforcing the operator's configured mediaRoot. In packages/next-tinacms-s3/src/handlers.ts, createMediaHandler accepts req.query.key for a signed PutObject URL and the DELETE path uses req.query.media as the DeleteObjectCommand key. The same missing key-boundary check exists in packages/next-tinacms-dos/src/handlers.ts, packages/next-tinacms-azure/src/handlers.ts, and packages/next-tinacms-cloudinary/src/handlers.ts. An authenticated CMS editor can therefore create or delete objects anywhere the deployment's storage credential can reach, including other tenants' or non-media objects. These issues are fixed in next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":5.4,"severity":null}],"references":["https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4","https://github.com/tinacms/tinacms/pull/7088","https://github.com/tinacms/tinacms/commit/d44558e9b4502d4f4fc2c970d22985339fe2b6ce","https://github.com/tinacms/tinacms/releases/tag/next-tinacms-s3@23.0.4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63102","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 19, 2026, 9:30:51 PM","dateUpdated":"Aug 21, 2026, 4:48:12 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-63102","identifiers":["EUVD-2026-63102","CVE-2026-59992","GHSA-8mq9-5fw2-5rm4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}