CVE-2026-29066 Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

What is CVE-2026-29066?

CVE-2026-29066 is a medium-severity path traversal vulnerability in @tinacms cli, published on 12 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.

Weakness: CWE-552, CWE-200

Which versions are affected by CVE-2026-29066?

2 open source packages ship an affected version, including @tinacms/cli. It affects 1 product.

Products include Ssw Tinacms\/Cli.

How do I fix CVE-2026-29066?

Upgrade @tinacms/cli to 2.1.8 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-29066 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29066 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in @tinacms cli

• CVE-2026-28792 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS Critical 9.7
• CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS High 8.6
• CVE-2026-28793 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS High 8.4
• CVE-2024-45391 Tina search token leak via lock file in TinaCMS High 7.5
• CVE-2026-28791 Path Traversal in Media Upload Handle in Tina High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m48g-4wr2-j2h6.