Path Traversal Vulnerability in Tina CMS Affects File Operations

CVE-2026-34604

What is CVE-2026-34604?

Tina, a headless content management system, is susceptible to a path traversal vulnerability in the @tinacms/graphql component. Prior to version 2.2.2, the system utilizes string-based path containment checks within FilesystemBridge, effectively blocking straightforward ../ traversal attacks. However, it fails to account for symlink or junction targets. As a consequence, if a symlink or junction exists within the permitted content root, operations such as get(), put(), delete(), and glob() may be performed on files that reside outside of the intended directory structure. The issue has been addressed and patched in version 2.2.2.

References