CVE-2026-34603

CVE-2026-34603 identifies a high-severity path traversal vulnerability (CWE-22, CWE-59) in Tina CMS, specifically affecting @tinacms/cli versions prior to 2.2.2. The flaw allows an attacker to bypass path validation in dev media routes by exploiting symlinks or junctions, enabling out-of-root media listing, writing, and deletion. Rated with a CVSS v3.1 score of 7.1 (High), the vulnerability requires high attack complexity but can be exploited over the network with low privileges, leading to significant confidentiality and integrity impacts. There is currently no evidence of active exploitation, nor are public exploit codes available, and community discussion remains minimal.