CVE-2026-29066 PoC — TinaCMS 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-29066.yaml

Associated Vulnerability

Title:TinaCMS 安全漏洞 (CVE-2026-29066)
Description:TinaCMS是Tina开源的一个用于 Markdown、MDX 和 JSON 的开源无头 CMS。 TinaCMS 2.1.8之前版本存在安全漏洞，该漏洞源于TinaCMS CLI开发服务器配置Vite时禁用了内置的文件系统访问限制，可能导致未经身份验证的攻击者读取主机系统上的任意文件。

Description

TinaCMS CLI < 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server.

File Snapshot


 id: CVE-2026-29066

info:
  name: TinaCMS - Path Traversal
  author: theamanrawat
  severity: medium

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!