https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:48:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275987 EUVD-2026-275987 https://cve.radiocsirt.org/vuln/euvd-2026-275987 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29066 <p>Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite&#39;s built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.</p> <p>Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite&#39;s built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29066 https://cve.radiocsirt.org/vuln/ghsa-m48g-4wr2-j2h6 <p><strong>Affected:</strong> npm: @tinacms/cli</p> <p>## Summary The TinaCMS CLI dev server configures Vite with `server.fs.strict: false`, which disables Vite&#39;s built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system</p> <p>## Details When running `tinacms dev`, the CLI starts a Vite dev server configured in: `packages/@tinacms/cli/src/next/vite/index.ts` ``` server: { host: configManager.config?.build?.host ?? false, ... fs: { strict: false, // Disables Vite&#39;s filesystem access restriction }, }, ``` TinaCMS middleware only intercepts specific route prefixes (/media/*, /graphql, /altair, /searchIndex). Any request to a path outside these routes falls through to Vite&#39;s default static file handler, which will serve the file directly from the absolute path on the filesystem. Additionally, the server enables permissive CORS (cors() with no origin restriction), which may further facilitate browser-based exploitation such as DNS rebinding attacks.</p> <p>## PoC</p> <p>**Prerequisites**: TinaCMS CLI dev server running (default port 4001).</p> <p>- Read system files directly: ``` curl http://localhost:4001/etc/passwd ``` &lt;img width=&#34;705&#34; height=&#34;332&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/6fd0e1c7-a549-40c8-bc81-af9c343f52a0&#34; /&gt;</p> <p>``` curl http://localhost:4001/etc/hostname ``` &lt;img width=&#34;631&#34; height=&#34;41&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/bd103dc3-d4c3-4774-8007-b55de3fc2a9e&#34; /&gt; Vite resolves and serves t…</p> <p><strong>Affected:</strong> npm: @tinacms/cli</p> <p>## Summary The TinaCMS CLI dev server configures Vite with `server.fs.strict: false`, which disables Vite&#39;s built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system</p> <p>## Details When running `tinacms dev`, the CLI starts a Vite dev server configured in: `packages/@tinacms/cli/src/next/vite/index.ts` ``` server: { host: configManager.config?.build?.host ?? false, ... fs: { strict: false, // Disables Vite&#39;s filesystem access restriction }, }, ``` TinaCMS middleware only intercepts specific route prefixes (/media/*, /graphql, /altair, /searchIndex). Any request to a path outside these routes falls through to Vite&#39;s default static file handler, which will serve the file directly from the absolute path on the filesystem. Additionally, the server enables permissive CORS (cors() with no origin restriction), which may further facilitate browser-based exploitation such as DNS rebinding attacks.</p> <p>## PoC</p> <p>**Prerequisites**: TinaCMS CLI dev server running (default port 4001).</p> <p>- Read system files directly: ``` curl http://localhost:4001/etc/passwd ``` &lt;img width=&#34;705&#34; height=&#34;332&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/6fd0e1c7-a549-40c8-bc81-af9c343f52a0&#34; /&gt;</p> <p>``` curl http://localhost:4001/etc/hostname ``` &lt;img width=&#34;631&#34; height=&#34;41&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/bd103dc3-d4c3-4774-8007-b55de3fc2a9e&#34; /&gt; Vite resolves and serves t…</p> https://cve.radiocsirt.org/vuln/ghsa-m48g-4wr2-j2h6