CVE-2026-34603: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34603 is a path traversal via symlink/junction bypass vulnerability in the @tinacms/graphql (and @tinacms/cli) npm package affecting all versions up to and including 2.2.1. The flaw exists in the dev media route handlers, which perform only lexical string-based path validation and fail to resolve symlink or junction targets before performing filesystem operations. It was published on March 30–April 1, 2026, and patched in version 2.2.2. The CVSS v3.1 base score is 7.1 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-22 (Path Traversal) and CWE-59 (Improper Link Resolution Before File Access). The resolveWithinBase and resolveStrictlyWithinBase functions in the media handlers use path.resolve() combined with a startsWith() check to validate that user-supplied paths remain within the media root directory. However, these checks operate purely on the lexical string representation of the path and do not call fs.realpath() to resolve symlinks or Windows junctions. If a symlink or junction already exists inside the media root pointing to a location outside it, an attacker can supply a path like pivot/secret.txt that passes the string-based check while the actual filesystem operation targets a file outside the media root. The validated path is then passed directly to fs.readdir(), fs.createWriteStream(), or fs.remove(), enabling out-of-root read, write, and delete operations (GitHub Advisory, Patch Commit).

An authenticated attacker with access to the TinaCMS dev media routes can list files outside the media root via /media/list/... endpoints, write arbitrary files outside the media root via /media/upload/... endpoints, and delete files outside the media root via DELETE operations on /media/.... This is particularly impactful in development and self-hosted environments where the media directory may intentionally or inadvertently contain symlinks or junctions as part of repository content. Successful exploitation could expose sensitive configuration files, source code, or credentials, and allow arbitrary file writes that could lead to further compromise such as planting malicious scripts (GitHub Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires low privileges (authenticated access to the dev media routes) and has high attack complexity because exploitation depends on a symlink or junction already existing within the media root directory. The EPSS score is approximately 0.101% (27th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Prerequisite — Symlink in media root: Confirm or arrange for a symlink or Windows junction to exist within the TinaCMS media root directory (e.g., public/uploads/pivot) pointing to a directory outside the media root (e.g., D:\outside or /etc). This link may already exist as part of repository content or a development environment setup.
2. Authenticate: Obtain valid credentials or a session token for the TinaCMS dev server (low-privilege user access is sufficient).
3. List out-of-root files: Send an HTTP GET request to the media list endpoint using the symlink name as the path component, e.g., GET /media/list/pivot. The lexical path check passes because <media_root>/pivot appears to be inside the media root, but the actual directory read follows the symlink to the outside location.
4. Read sensitive files: Identify sensitive files revealed in the listing (e.g., secret.txt, .env, configuration files) and access them through the media endpoint.
5. Write arbitrary files: Send an HTTP POST/upload request to /media/upload/pivot/malicious.php (or another target path through the symlink). The validated path passes the string check, and fs.createWriteStream writes the file to the symlink target outside the media root.
6. Delete files: Send an HTTP DELETE request to /media/pivot/<target_file> to delete files outside the media root using the same bypass (GitHub Advisory, Patch Commit).

• Network: Unusual HTTP GET requests to /media/list/<symlink-name> or POST requests to /media/upload/<symlink-name>/... where <symlink-name> corresponds to a symlink or junction in the media directory; unexpected file paths appearing in media listing API responses that reference content outside the media root.
• File System: Presence of unexpected symlinks or junctions within the TinaCMS media root directory (e.g., public/uploads/<name>) pointing to directories outside the media tree; newly created or modified files in directories outside the media root that correspond to upload operations; unexpected deletion of files outside the media root.
• Logs: TinaCMS dev server access logs showing repeated requests to /media/list/, /media/upload/, or DELETE /media/ endpoints with path components matching symlink names; file access events (via OS audit logging or filesystem monitoring) on paths outside the configured media root originating from the Node.js/TinaCMS process.

Upgrade @tinacms/cli and @tinacms/graphql to version 2.2.2 or later, which resolves the vulnerability by adding fs.realpathSync-based symlink resolution after the lexical path check, ensuring the real filesystem target is also within the media root (Patch Commit, Github Advisory). As interim mitigations: audit the media directory for any symlinks or junctions pointing outside the media root and remove unintended ones; restrict access to the TinaCMS dev server to trusted localhost users only (the patched version also adds a startup warning when the server is exposed on a non-localhost address); and implement filesystem monitoring to detect unauthorized file access outside designated media directories.