@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

Description

@tinacms/graphql uses string-based path containment checks in FilesystemBridge:

• path.resolve(path.join(baseDir, filepath))
• startsWith(resolvedBase + path.sep)

That blocks plain ../ traversal, but it does not resolve symlink or junction targets.

Recommendation

Update the @tinacms/graphql package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.2.0
• Patched version(s): 2.2.2

References

• GHSA-g9c2-gf25-3x67
• CVE-2026-34604
• CWE-22
• CWE-59
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6