CVE-2026-34603 — @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

Back Back to CVE browser

HIGH

@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

Published Apr 1, 2026

8.3

HIGH

CVSS 3.1

EPSS 0.46%

Description

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the media root, Tina accepts a path like pivot/written-from-media.txt as "inside" the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete. This issue has been patched in version 2.2.2.

Affected products

Vendor Tinacms Product Tinacms Default
n/a
- Version
  < 2.2.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tinacms

n/a

Version	Status	Constraints
< 2.2.2	affected	-

Ecosystem	Package	Introduced	Fixed
npm	@tinacms/graphql	0	2.2.2

Remediation

No remediation recorded yet.

Metrics

0.46% 0.00461

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00461

Score over time

Apr–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.46% (0.00461)	37.62th	v5 (v2026.06.15)
Jun 15, 2026	0.41% (0.00415)	32.90th	v5 (v2026.06.15)
Apr 2, 2026	0.06% (0.00061)	19.31th	v4 (v2025.03.14)

Weaknesses (2)

CWE-22

Path Traversal

CWE-59

References (4)

https://github.com/advisories/GHSA-g87c-r2jp-293w
Advisory
https://github.com/tinacms/tinacms/commit/f124eabaca10dac9a4d765c9e4135813c4830955
x_refsource_MISCPatch
https://github.com/tinacms/tinacms/security/advisories/GHSA-g87c-r2jp-293w
exploitx_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34603

Link	Providers	Tags
https://github.com/advisories/GHSA-g87c-r2jp-293w		Advisory
https://github.com/tinacms/tinacms/commit/f124eabaca10dac9a4d765c9e4135813c4830955		x_refsource_MISCPatch
https://github.com/tinacms/tinacms/security/advisories/GHSA-g87c-r2jp-293w		exploitx_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34603