CVE-2026-29066CWE-200CWE-552

Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

Medium · published March 12, 2026

CVSS v3.1
6.2
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00559 · 45.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-552 · Files or Directories Accessible to External Parties
Published
2026-03-12T16:57Z
EPSS history
Timeline
  • 12 MAR 16:57Z
    Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI
    cvelistv5