Approved changes feed: RSS · Atom
cpe:2.3:a:@tinacms:cli:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | @Tinacms (28c7a649-a488-565c-81aa-baed2d03ab58) |
|---|---|
| Product | Cli (3bf1b2d3-a3ec-5f1f-9bde-6159574cb03d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-29066 |
vulnerable | 2026-06-03 15:19:22.829064 |
Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI
MEDIUM (6.2)
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
Published: 2026-03-12T16:57:41.393Z
Updated: 2026-03-13T16:27:22.344Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28793 |
vulnerable | 2026-06-03 15:19:22.350870 |
Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS
HIGH (8.4)
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.
Published: 2026-03-12T16:50:20.132Z
Updated: 2026-03-13T16:28:33.184Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28792 |
vulnerable | 2026-06-03 15:19:22.350108 |
Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
CRITICAL (9.7)
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.
Published: 2026-03-12T16:48:16.461Z
Updated: 2026-03-13T16:29:06.236Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.