CVE-2026-29066
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
- Affected products
- @Tinacms/Cli, Cli, Tinacms
- Ssw Tinacms\/cli
- < 2.1.8
- Fix
- Available
- CVSS 3.1
- 6.2 MEDIUM
- EPSS
- 1.0% (60th percentile)
- Weakness
- CWE-200, CWE-552
- NVD status
- Analyzed
- Published
- 2026-03-12
CVE-2026-29066 at NVD
No indexed exploits for CVE-2026-29066 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-29066 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.