CVE-2026-34604

CVE-2026-34604 impacts Tina CMS versions prior to 2.2.2, specifically within the @tinacms/graphql component's FilesystemBridge. This vulnerability allows for a path traversal bypass by failing to properly resolve symlinks or junction targets, enabling an attacker to access, modify, or delete files outside the intended content root. Rated with a CVSS score of 7.1 (High), exploitation requires low privileges but has high attack complexity, leading to high confidentiality and integrity impacts. There is currently no evidence of active exploitation or public exploit code, and community discussion remains minimal.