CVE-2026-34604: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34604 is a path traversal via symlink/junction bypass vulnerability in the @tinacms/graphql package's FilesystemBridge component. It affects all versions up to and including 2.2.1 (the advisory lists affected versions as <= 2.2.0 in some sources and <= 2.2.1 in others), and was patched in version 2.2.2. The vulnerability was published to the GitHub Advisory Database on April 1, 2026, with the security advisory (GHSA-g9c2-gf25-3x67) originally authored by wicksipedia on March 30, 2026. It carries a CVSS v3.1 base score of 7.1 (High) per the official GitHub advisory (Github Advisory, TinaCMS Advisory).

The root cause is a classic "realpath gap" (CWE-22, CWE-59): the assertWithinBase() function in FilesystemBridge validates paths using only lexical string normalization (path.resolve + startsWith), which blocks plain ../ traversal but does not resolve symlink or junction targets before performing filesystem I/O. If a symlink or junction already exists within the allowed content root (e.g., content/posts/pivot pointing to a directory outside the root), a path like content/posts/pivot/owned.md passes the string-based check but the actual I/O operates on the symlink's real target outside the intended directory. This flaw affects FilesystemBridge.get(), put(), delete(), and glob(), all of which are reachable via TinaCMS's GraphQL/local database flow where user-controlled relativePath values are used to construct file paths (TinaCMS Advisory, Patch Commit).

Authenticated users can perform arbitrary file read, write, and delete operations on files outside the configured content root by leveraging pre-existing or attacker-placed symlinks/junctions within the content tree. An attacker could read sensitive files from the server filesystem (e.g., credentials, configuration files), overwrite or delete critical files outside the intended content directory, or corrupt application state. This vulnerability is particularly dangerous in environments where symlinks or junctions may be committed to version control or where an attacker has any degree of filesystem access to plant a link before issuing GraphQL content operations (TinaCMS Advisory, Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.103% (28th percentile), indicating a low near-term exploitation probability. The vulnerability requires low privileges (authenticated access) and network-level access to the TinaCMS GraphQL endpoint, but also requires that a symlink or junction already exist within the content root — either committed to version control or placed by an attacker with some filesystem access. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Precondition — Place or identify a symlink/junction: Ensure a symlink (Unix/Linux/macOS) or junction (Windows) exists within the TinaCMS content root pointing to a directory outside it. For example, content/posts/pivot → /etc/ or D:\sensitive\. This may already exist if committed to version control, or an attacker with filesystem access can create it.
2. Authenticate to TinaCMS: Obtain low-privilege credentials to access the TinaCMS GraphQL or local database API endpoint.
3. Craft a malicious GraphQL request: Issue a content operation (read, write, or delete) targeting a relativePath that traverses through the symlink, e.g., relativePath: "pivot/passwd" within the posts collection. The string-based assertWithinBase() check will accept this path as valid since it lexically resolves within content/posts/.
4. Achieve out-of-root file access: The FilesystemBridge performs real I/O following the symlink target. For a read (get()), the server returns the contents of the file outside the content root. For a write (put()), arbitrary content is written to the target outside the root. For a delete (delete()), the file outside the root is removed.
5. Exfiltrate or manipulate data: Use the read primitive to extract sensitive files (e.g., environment files, SSH keys, application secrets), or use the write primitive to plant malicious content or overwrite configuration files (TinaCMS Advisory, Patch Commit).

• File System: Presence of unexpected symlinks or directory junctions within the TinaCMS content root (e.g., content/posts/<name> pointing to a directory outside the project); newly created or modified files in directories outside the configured content root that correspond to TinaCMS write operations.
• Logs: TinaCMS GraphQL access logs showing content operation requests (get/put/delete) with relativePath values containing directory names that correspond to symlinks; file access events (via auditd on Linux or Windows Security Event Log) showing the TinaCMS process reading or writing files outside the content root.
• Network: Unusual or repeated GraphQL mutation/query requests to the TinaCMS local server endpoint targeting paths that traverse through symlinked directories; outbound connections from the TinaCMS server process to unexpected destinations following file read operations.
• Process: The Node.js process running TinaCMS performing file I/O (via fs.readFile, fs.outputFile, fs.remove) on paths outside the expected content root directory, observable via process monitoring tools (e.g., strace, inotifywait, Sysmon on Windows) (TinaCMS Advisory).

Upgrade @tinacms/graphql to version 2.2.2 or later, which implements realpath-aware containment checks using fs.realpathSync() to compare canonical filesystem paths rather than relying solely on string-based normalization (Patch Commit). As an interim measure, audit the content root for any existing symlinks or junctions that point outside the intended directory tree and remove them. Additionally, restrict filesystem permissions so that the TinaCMS process account cannot follow symlinks to sensitive directories, and limit GraphQL/content operation exposure to trusted, authenticated users only. The patched version also adds a dev server warning when the host is configured to listen on a non-localhost address, reducing unintended network exposure (Github Advisory).

The vulnerability was reported via Bugcrowd and published by wicksipedia on March 30, 2026, with the TinaCMS maintainers releasing a patch promptly in version 2.2.2. The fix was co-authored with Claude (Anthropic's AI coding assistant), as noted in the commit message. No significant broader media coverage or notable independent researcher commentary beyond the official advisory has been identified (TinaCMS Advisory, Patch Commit).