CVE-2026-29066 Details
Description
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
A vulnerability in the TinaCMS CLI dev server prior to version 2.1.8 allows unauthenticated attackers to read arbitrary files from the host system. This issue arises because the dev server disables Vite's built-in filesystem access restrictions, enabling file access through Vite's default static file handler. The vulnerability can be exploited by any attacker who can reach the dev server, particularly in environments where the server port is publicly accessible or via DNS rebinding attacks.
Users can upgrade to TinaCMS version 2.1.8 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinacms/tinacms/security/advisories/GHSA-m48g-4wr2-j2h6 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/tinacms/tinacms/security/advisories/GHSA-m48g-4wr2-j2h6 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ssw tinacms/cli | < 2.1.8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Mar 13, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | New CVE Received | [email protected] |