next-tinacms-s3 Broken Access Control Vulnerability (CVE-2025-59992) Advisory

Vulnerability Overview Vulnerability Name: Broken Access Control: arbitrary bucket-key write/delete in (and sibling production media adapters) Description: The media handler in accepts an attacker-controlled parameter and returns a signed PUT/DELETE URL that can access any object, without verifying whether the key belongs to the operator's configured media prefix. Any caller can overwrite any object authorized by the operator, i.e., any object accessible by an IAM user in a typical TinaCloud/self-hosted deployment. The vulnerability allows writing to and deleting any object in the entire S3 bucket, not just the media locations specified in the package documentation. Impact Scope Affected Versions: <= 21.0.3 Fixed Version: 21.0.3 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: High - Availability: Low CVE ID: CVE-2025-59992 Weaknesses: CWE-639, CWE-862 Remediation Fixed Version: Upgrade to version 21.0.3 or higher. POC Code Validation Details Exhibit A: An attacker can generate a pre-signed PUT URL for an arbitrary bucket key. Exhibit B: Cross-tenant overwrite attack; an attacker can overwrite files belonging to other tenants. Exhibit C: Arbitrary key DELETE attack; an attacker can delete any bucket key. Exhibit D: Attacker-controlled parameter, allowing the generation of long-lived signed URLs. Impact Cross-tenant/cross-media-root write: In deployments, authorized editors can write to and delete any object in the entire S3 bucket. Stored XSS via HTML upload: Attackers can upload HTML files, leading to stored cross-site scripting. Arbitrary key deletion: Attackers can delete any object in the entire S3 bucket. Bucket policy implications: The package documentation implies that application code constrains editor operations to the media prefix, but the actual implementation does not enforce this. Long-lived offline URL primitives: Attackers can generate long-lived signed URLs to continuously write arbitrary objects. Same issues in other media adapters: , , and suffer from similar issues.

Goal Reached Thanks to every supporter — we hit 100%!

next-tinacms-s3 Broken Access Control Vulnerability (CVE-2025-59992) Advisory

More from this source