CVE-2026-34604 Details

A path traversal vulnerability has been identified in Tina CMS versions prior to 2.2.2, specifically within the @tinacms/graphql package. The issue arises in the FilesystemBridge component, where string-based path validation checks fail to properly resolve symlink or junction targets. This flaw allows operations to be performed on files outside the intended content root. The vulnerability can be exploited by creating a symlink or junction that points to a location outside the allowed directory, bypassing the application's path validation. As a result, FilesystemBridge methods such as get(), put(), delete(), and glob() can inadvertently access or modify files beyond the designated content root.

Users can update to Tina CMS version 2.2.2 or later, where this vulnerability has been patched. The patch involves changing the path validation to resolve symlinks and junctions, ensuring that all filesystem operations stay within the intended content root.