Description
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| @tinacms | cli | < 2.1.8 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- TinaCMS - Path Traversal http/cves/2026/CVE-2026-29066.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @tinacms/cli | < 2.1.8 | 2.1.8 | GHSA-m48g-4wr2-j2h6 |