CVE-2026-34603: @tinacms/graphql Media Endpoints Vulnerability Allowing Path Traversal via Symlinks
Summary
CVE-2026-34603: @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions. Affects @tinacms/graphql versions < 2.2.2. Fixed in 2.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @tinacms/graphql package is part of the TinaCMS framework, which provides a headless content management system for React applications. It facilitates media management through various endpoints, allowing users to upload, list, and delete media files. However, the package has a vulnerability that arises from inadequate validation of file paths, specifically concerning symlinks and junctions, which can lead to unauthorized access to files outside the intended media directory.
Vulnerability Detail
The vulnerability stems from the implementation of lexical path-traversal checks in the media endpoints of @tinacms/graphql. While the package attempts to validate user-controlled paths, it only checks the path string without resolving symlinks or junctions. This oversight allows attackers to exploit existing symlinks or junctions within the media root, enabling them to list, write, and potentially delete files outside the designated media directory. The impact includes unauthorized file access and manipulation, which poses a significant security risk, especially in development environments where symlinks may be present.
How To Fix
Minimum fixed version
2.2.2
This is the first release that contains the fix.
npm install @tinacms/graphql@2.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using symlinks or junctions within the media directory until the package is updated. Ensure that all media files are stored directly within the media root to mitigate the risk of path traversal attacks.
Conclusion
The CVE-2026-34603 vulnerability in the @tinacms/graphql package highlights the importance of proper path validation in file management systems. By updating to the patched version and avoiding symlinks in the media directory, users can protect their applications from potential security risks associated with this vulnerability.
See every vulnerability recorded for @tinacms/graphql →
FAQ
CVE-2026-34603 is a vulnerability in the @tinacms/graphql package that allows path traversal through symlinks, enabling unauthorized access to files outside the media directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized file listing, writing, and deletion, posing significant security risks, especially in development environments.
Yes, the vulnerability is patched in version 2.2.2 of the @tinacms/graphql package. Updating to this version will resolve the issue.
If immediate updating is not possible, avoid using symlinks or junctions in the media directory as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for @tinacms/graphql.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
