Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CVE-2026-29066 - medium 🚨 TinaCMS - Path Traversal > TinaCMS CLI < 2.1.8 contains a file system read vulnerability caused by disabled Vite... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-29066 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE-2026-29066 as a path traversal issue in TinaCMS CLI affecting versions <2.1.8, with a brief technical description and a link to a detection library.
CVE-2026-29066 Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in … https://www.cve.org/CVERecord?id=CVE-2026-29066
Post summary
CVE‑2026‑29066 describes a configuration flaw in TinaCMS 2.x that disables Vite’s file‑system security checks; upgrading to v2.1.8 addresses the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ssw | tinacms\/cli | - | node.js | - |