CVE-2026-28791 | tinacms up to 2.1.6 media.ts join path traversal (GHSA-5hxf-c7j4-279c)

A vulnerability identified as critical has been detected in tinacms up to 2.1.6. Affected is the function join of the file media.ts. The manipulation leads to path traversal.

This vulnerability is listed as CVE-2026-28791. The attack may be initiated remotely. There is no available exploit.

You should upgrade the affected component.