Approved changes feed: RSS · Atom

cpe:2.3:a:@tinacms:cli:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor@Tinacms (28c7a649-a488-565c-81aa-baed2d03ab58)
ProductCli (3bf1b2d3-a3ec-5f1f-9bde-6159574cb03d)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-29066 vulnerable 2026-06-03 15:19:22.829064 Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI
MEDIUM (6.2)
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
Published: 2026-03-12T16:57:41.393Z
Updated: 2026-03-13T16:27:22.344Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28793 vulnerable 2026-06-03 15:19:22.350870 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS
HIGH (8.4)
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.
Published: 2026-03-12T16:50:20.132Z
Updated: 2026-03-13T16:28:33.184Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28792 vulnerable 2026-06-03 15:19:22.350108 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
CRITICAL (9.7)
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.
Published: 2026-03-12T16:48:16.461Z
Updated: 2026-03-13T16:29:06.236Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.