PT-2026-25014 · Npm+3 · @Tinacms/Cli+2
Alaeddine03
·
Publicado
2026-03-12
·
Atualizado
2026-04-09
·
CVE-2026-29066
CVSS v3.1
6.2
Média
| Vetor | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
TinaCMS versions prior to 2.1.8
Description
TinaCMS is a headless content management system. Before version 2.1.8, the TinaCMS CLI development server configures Vite with
server.fs.strict: false, disabling Vite’s built-in filesystem access restriction. This allows an unauthenticated attacker who can reach the development server to read arbitrary files on the host system. The development server is configured in packages/@tinacms/cli/src/next/vite/index.ts. The server enables permissive CORS, potentially facilitating browser-based exploitation like DNS rebinding attacks. An attacker can read any file readable by the server process, including sensitive information like /etc/passwd, /etc/shadow, SSH private keys, and environment variables. This is particularly dangerous in cloud IDEs, Docker/VM setups with port forwarding, misconfigured environments, and systems susceptible to DNS rebinding attacks.Recommendations
Versions prior to 2.1.8 should be updated to version 2.1.8 or later.
Exploit
Correção
Files Accessible to External Parties
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
@Tinacms/Cli
Cli
Tinacms