CVE-2026-29066

Katalog CVE

CVSS 6.2 · Medium EPSS 0,56%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada ssw tinacms/cli. Skor CVSS 3.1 6.2 (Medium) menurut github.com.

Deskripsi (NVD)

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.

Rincian

Terbit di NVD

12 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.2 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tinacms/tinacms/security/advisories/GHSA-m48g-4wr2-j2h6 exploit · advisory vendor