@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

Description

@tinacms/graphql uses string-based path containment checks in FilesystemBridge:

• path.resolve(path.join(baseDir, filepath))
• startsWith(resolvedBase + path.sep)

That blocks plain ../ traversal, but it does not resolve symlink or junction targets.

Recommendation

Update the @tinacms/graphql package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.2.0
• Patched version(s): 2.2.2

References

• GHSA-g9c2-gf25-3x67
• CVE-2026-34604
• CWE-22
• CWE-59
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions - CVE-2026-34603
• @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files - CVE-2026-33949
• @tinacms/graphql has a Path Traversal issue - CVE-2026-24125
• jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.set - CVE-2026-4600

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@tinacms/graphql