CVE-2026-29066 MEDIUM

CVE-2026-29066: Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

Vendor @Tinacms
Product cli
Weakness CWE-552 · Files accessible externally
Published March 12, 2026
Last update March 13, 2026
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.

Key dates

02Disclosure timeline

March 12, 2026 CVE published
March 13, 2026 Record updated