CVE-2026-34604: TinaCMS GraphQL FilesystemBridge path traversal via symlinks

CVE-2026-34604 · Severity: low · CVSS 3.1 · Published 2026-04-01

TinaCMS is a headless CMS used for content management and publishing. Its GraphQL API includes a file bridge component that validates paths to restrict file access to a configured content directory. However, the validation uses string-based checks that do not follow symbolic links or directory junctions, allowing attackers to read, write, or delete files outside the intended content root by exploiting symlinks that exist within the content directory.

Technologies: @tinacms/graphql (npm). Vendors: npm.

Quick answers

Is CVE-2026-34604 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34604 being exploited in the wild.
How severe is CVE-2026-34604?
Low severity, with a CVSS score of 3.1, published 1 April 2026.
Which products and versions are affected?
@tinacms/graphql (npm) SEMVER:introduced=0,fixed=2.2.2.
Is there a fix for CVE-2026-34604?
Yes. @tinacms/graphql (npm): upgrade to 2.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34604 attacked?
It is attacked over the network.
Am I affected by CVE-2026-34604?
Check whether you run @tinacms/graphql (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @tinacms/graphql (npm): upgrade to 2.2.2 or later
    npm install @tinacms/graphql@2.2.2

Technical details

@tinacms/graphql's FilesystemBridge performs path containment validation using lexical string comparison (path.resolve + startsWith) rather than canonical filesystem paths. The validation blocks simple ../ traversal but fails to resolve symlink or junction targets, creating a "realpath gap": an attacker who can place or exploit a symlink/junction inside an allowed collection path (e.g., content/posts/pivot → /etc) can bypass the containment check. The vulnerable functions include get(), put(), delete(), and glob() which perform actual filesystem I/O after the flawed validation. Attack requires the symlink/junction to already exist within the content tree or for the attacker to create one before issuing GraphQL operations. The fix requires comparing canonical (realpath-resolved) paths rather than lexical string paths for all filesystem boundaries.

Affected products

  • TinaCMS @tinacms/graphql <=2.2.0

Identifiers

  • CVE-2026-34604
  • GHSA-g9c2-gf25-3x67

Timeline

  • 2026-03-30: disclosed
  • 2026-04-01: advisory
  • 2026-04-01: patched: Version 2.2.2 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.