Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the media root, Tina accepts a path like pivot/written-from-media.txt as "inside" the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete. This issue has been patched in version 2.2.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
📁 CVE-2026-34603 (tinacms/graphql Media Endpoints): High escape media root via symlinks—file disclosure/exfil. Patch: Update @tinacms/graphql https://www.tenable.com/cve/newest https://nvd.nist.gov/vuln/detail/CVE-2026-34603 https://github.com/tinacms/graphql/security/advisories
Post summary
The post announces CVE-2026-34603 affecting tinacms/graphql, details a directory escape via symlinks, and provides a patch recommendation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ssw | tinacms\/cli | - | node.js | - |