CVE-2026-34603
Description
Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the media root, Tina accepts a path like pivot/written-from-media.txt as "inside" the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete. This issue has been patched in version 2.2.2.
How to fix
- @tinacms/graphql2.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ssw tinacms\/cli | v ≤ 2.2.1 | — |
| @tinacms/graphqlnpm | v < 2.2.2 | 2.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.