https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:05:17 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-278511 EUVD-2026-278511 https://cve.radiocsirt.org/vuln/euvd-2026-278511 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34603 <p>Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the media root, Tina accepts a path like pivot/written-from-media.txt as &#34;inside&#34; the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete. This issue has been patched in version 2.2.2.</p> <p>Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the media root, Tina accepts a path like pivot/written-from-media.txt as &#34;inside&#34; the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete. This issue has been patched in version 2.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34603 https://cve.radiocsirt.org/vuln/ghsa-g87c-r2jp-293w <p><strong>Affected:</strong> npm: @tinacms/graphql</p> <p>## Summary</p> <p>`@tinacms/cli` recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets.</p> <p>If a link already exists under the media root, Tina accepts a path like `pivot/written-from-media.txt` as &#34;inside&#34; the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete.</p> <p>## Details</p> <p>The dev media handlers validate user-controlled paths with:</p> <p>```ts function resolveWithinBase(userPath: string, baseDir: string): string { const resolvedBase = path.resolve(baseDir); const resolved = path.resolve(path.join(baseDir, userPath)); if (resolved === resolvedBase) { return resolvedBase; } if (resolved.startsWith(resolvedBase + path.sep)) { return resolved; } throw new PathTraversalError(userPath); }</p> <p>function resolveStrictlyWithinBase(userPath: string, baseDir: string): string { const resolvedBase = path.resolve(baseDir) + path.sep; const resolved = path.resolve(path.join(baseDir, userPath)); if (!resolved.startsWith(resolvedBase)) { throw new PathTraversalError(userPath); } return resolved; } ```</p> <p>But the validated path is then used directly for real filesystem access:</p> <p>```ts filesStr = await fs.readdir(validatedPath); ... await fs.ensureDir(path.dirname(saveTo)); file.pipe(fs.createWriteStream(saveTo)); ... aw…</p> <p><strong>Affected:</strong> npm: @tinacms/graphql</p> <p>## Summary</p> <p>`@tinacms/cli` recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets.</p> <p>If a link already exists under the media root, Tina accepts a path like `pivot/written-from-media.txt` as &#34;inside&#34; the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete.</p> <p>## Details</p> <p>The dev media handlers validate user-controlled paths with:</p> <p>```ts function resolveWithinBase(userPath: string, baseDir: string): string { const resolvedBase = path.resolve(baseDir); const resolved = path.resolve(path.join(baseDir, userPath)); if (resolved === resolvedBase) { return resolvedBase; } if (resolved.startsWith(resolvedBase + path.sep)) { return resolved; } throw new PathTraversalError(userPath); }</p> <p>function resolveStrictlyWithinBase(userPath: string, baseDir: string): string { const resolvedBase = path.resolve(baseDir) + path.sep; const resolved = path.resolve(path.join(baseDir, userPath)); if (!resolved.startsWith(resolvedBase)) { throw new PathTraversalError(userPath); } return resolved; } ```</p> <p>But the validated path is then used directly for real filesystem access:</p> <p>```ts filesStr = await fs.readdir(validatedPath); ... await fs.ensureDir(path.dirname(saveTo)); file.pipe(fs.createWriteStream(saveTo)); ... aw…</p> https://cve.radiocsirt.org/vuln/ghsa-g87c-r2jp-293w