CVE-2026-59992

## Summary The production media handler shipped by `next-tinacms-s3` (`createMediaHandler` in `packages/next-tinacms-s3/src/handlers.ts`) accepts an attacker-chosen `?key=` query parameter and returns an AWS-signed `PutObject` URL whose `Key` is that value, with no check that the key falls under the operator's configured `mediaRoot`. The same handler's `DELETE` branch reads `objectKey = (req.query.media as string[])[1]` and dispatches a `DeleteObjectCommand` for that exact key, again unbounded by `mediaRoot`. Any caller that passes the operator-supplied `authorized()` predicate — i.e. any logged-in CMS editor in a typical TinaCloud / self-hosted deployment — therefore has write and delete authority over the *entire* S3 bucket the IAM key can reach, even though the package documents `mediaRoot` as the place where editors are scoped. The same shape is present in `next-tinacms-dos`, `next-tinacms-azure`, and `next-tinacms-cloudinary`, so a single design mistake spans every first-party production media backend. * Project: TinaCMS — first-party production media adapters (consumed by self-hosted Next.js sites and TinaCloud-backed deployments). * Source reviewed: `tinacms/tinacms` @ `main` (`b56dad4`). * Deployed artefact validated: `[email protected]` handler logic, exercised against `@aws-sdk/[email protected]` via `[email protected]` (the AWS SDK signs the URL identically whether the bucket is real or mocked). * Affected file(s): * `packages/next-tinacms-s3/src/handlers.ts:67-90` — `GET ?key=` returns presigned `PutObjectCommand` URL with attacker-chosen `Key`. * `packages/next-tinacms-s3/src/handlers.ts:199-223` — `DELETE` reads `[, objectKey] = media` and issues `DeleteObjectCommand` against attacker-chosen `Key`. * `packages/next-tinacms-dos/src/handlers.ts:79-152` and `:249-278` — same write/delete pattern, plus a server-side upload that builds the key with `path.join(mediaRoot, prefix + filename)` over attacker-controlled `directory` and `filen