{"id":"CVE-2026-34603","aliases":["GHSA-g87c-r2jp-293w"],"url":"https://o3.security/vulnerability/CVE-2026-34603","summary":"@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions","details":"## Summary\n\n`@tinacms/cli` recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets.\n\nIf a link already exists under the media root, Tina accepts a path like `pivot/written-from-media.txt` as \"inside\" the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete.\n\n## Details\n\nThe dev media handlers validate user-controlled paths with:\n\n```ts\nfunction resolveWithinBase(userPath: string, baseDir: string): string {\n  const resolvedBase = path.resolve(baseDir);\n  const resolved = path.resolve(path.join(baseDir, userPath));\n  if (resolved === resolvedBase) {\n    return resolvedBase;\n  }\n  if (resolved.startsWith(resolvedBase + path.sep)) {\n    return resolved;\n  }\n  throw new PathTraversalError(userPath);\n}\n\nfunction resolveStrictlyWithinBase(userPath: string, baseDir: string): string {\n  const resolvedBase = path.resolve(baseDir) + path.sep;\n  const resolved = path.resolve(path.join(baseDir, userPath));\n  if (!resolved.startsWith(resolvedBase)) {\n    throw new PathTraversalError(userPath);\n  }\n  return resolved;\n}\n```\n\nBut the validated path is then used directly for real filesystem access:\n\n```ts\nfilesStr = await fs.readdir(validatedPath);\n...\nawait fs.ensureDir(path.dirname(saveTo));\nfile.pipe(fs.createWriteStream(saveTo));\n...\nawait fs.remove(file);\n```\n\nThis does not account for symlinks/junctions already present below the media root. A path such as `pivot/secret.txt` can be lexically inside the media directory while the filesystem target is outside it.\n\n## Local Reproduction\n\nI verified this locally with a real junction on Windows.\n\nTest layout:\n\n- media root: `D:\\bugcrowd\\tinacms\\temp\\junction-repro4\\public\\uploads`\n- junction under media root: `public\\uploads\\pivot -> D:\\bugcrowd\\tinacms\\temp\\junction-repro4\\outside`\n- file outside the media root: `outside\\secret.txt`\n\nTina's current media-path validation logic was applied and used to perform the same list/write operations the route handlers use.\n\nObserved result:\n\n```json\n{\n  \"media\": {\n    \"base\": \"D:\\\\bugcrowd\\\\tinacms\\\\temp\\\\junction-repro4\\\\public\\\\uploads\",\n    \"resolvedListPath\": \"D:\\\\bugcrowd\\\\tinacms\\\\temp\\\\junction-repro4\\\\public\\\\uploads\\\\pivot\",\n    \"listedEntries\": [\n      \"secret.txt\"\n    ],\n    \"resolvedWritePath\": \"D:\\\\bugcrowd\\\\tinacms\\\\temp\\\\junction-repro4\\\\public\\\\uploads\\\\pivot\\\\written-from-media.txt\",\n    \"outsideWriteExists\": true,\n    \"outsideWriteContents\": \"MEDIA_ESCAPE\"\n  }\n}\n```\n\nThis shows the problem clearly:\n\n- the path validator accepted `pivot`\n- listing revealed a file from outside the media root\n- writing to `pivot/written-from-media.txt` created `outside\\written-from-media.txt`\n\nThe delete path uses the same flawed containment model and should be hardened at the same time.\n\n## Impact\n\n- **Out-of-root file listing** via `/media/list/...`\n- **Out-of-root file write** via `/media/upload/...`\n- **Likely out-of-root file delete** via `/media/...` `DELETE`, using the same path-validation gap\n- **Bypass of the recent path traversal hardening** for any deployment whose media tree contains a link to another location\n\nThis is especially relevant in development and self-hosted workflows where the media directory may contain symlinks or junctions intentionally or via repository content.\n\n## Recommended Fix\n\nHarden media path validation with canonical filesystem checks:\n\n1. resolve the real base path with `fs.realpath()`\n2. resolve the real target path, or for writes the nearest existing parent\n3. compare canonical paths rather than lexical strings\n4. reject any operation that traverses through a symlink/junction to leave the real media root\n\n`path.resolve(...).startsWith(...)` is not sufficient for filesystem security on linked paths.\n\n## Resources\n\n- `packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts`\n- `packages/@tinacms/cli/src/server/models/media.ts`\n- `packages/@tinacms/cli/src/utils/path.ts`","published":"2026-04-01T16:08:44.366Z","modified":"2026-10-28T02:30:43.452099199Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@tinacms/graphql","fixedVersion":"2.2.2"}],"fix":{"url":"https://github.com/tinacms/tinacms/commit/f124eabaca10dac9a4d765c9e4135813c4830955","label":"tinacms/tinacms@f124eab"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34603.json"},{"type":"ADVISORY","url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-g87c-r2jp-293w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34603"},{"type":"FIX","url":"https://github.com/tinacms/tinacms/commit/f124eabaca10dac9a4d765c9e4135813c4830955"},{"type":"PACKAGE","url":"https://github.com/tinacms/tinacms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:43.452099199Z"}}