CVE-2026-34603: Path Traversal in @tinacms/graphql

The vulnerability stems from insufficient validation of user-controlled paths within the dev media handlers. While lexical checks are in place, they fail to resolve symlink or junction targets. Consequently, an attacker can craft a path, such as pivot/written-from-media.txt, that exploits existing links within the media root. This enables out-of-root media listing and write access. The potential impact includes unauthorized access to sensitive files, modification of critical system configurations, and potentially, remote code execution if the attacker can leverage the write access to inject malicious code. This is particularly concerning in environments where media files contain sensitive data or are used in automated build processes.

1. Reserved2026-03-30
2. Published2026-04-01
3. Modified2026-04-06
4. EPSS updated2026-04-09

The primary mitigation is to upgrade to @tinacms/graphql version 2.2.2 or later, which includes the necessary path validation improvements. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious path patterns, such as those containing .. or symbolic link references. Additionally, restrict access to the dev media routes to trusted users and networks. Regularly review and audit file permissions within the media directory to ensure least privilege access.