The vulnerability occurs because TinaCMS CLI's development server configures Vite with server.fs.strict set to false before version 2.1.8. This disables Vite's filesystem access restriction, allowing any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. The primary impact is information disclosure that could expose confidential data, credentials, or code, potentially leading to further compromise. The weakness maps to CWE-200 (Information Exposure) and CWE-552 (Unrestricted Input).

The affected product is the @tinacms:cli command-line interface for Tina, a headless CMS. All installations of TinaCMS CLI prior to version 2.1.8 are affected. The vulnerability is specifically tied to the development server configuration within those versions.

The CVSS score for this issue is 6.2, indicating a medium severity. The EPSS score is below 1%, implying a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this remotely and without authentication by simply accessing the development server over the network. However, the requirement for the dev server to be exposed makes it less likely a widespread target. Nevertheless, early patching is advised to prevent potential data leaks.