Medium severity · published Mar 12, 2026
CVE-2026-29066
Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI
6.2
CVSS
1%
EPSS
No
On KEV
Description
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
cli · @tinacms
< 2.1.8 · source: vendor
TI
Tinacms/cli · Ssw
before 2.1.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29066
Exploit
https://github.com/tinacms/tinacms/security/advisories/GHSA-m48g-4wr2-j2h6
More from cli
9.6
CVE-2026-28792
Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
8.4
CVE-2026-28793
Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS
8.2
CVE-2026-108259
Tina: Code injection via unescaped Git branch name in generated client source