Cyber Resilience

CVE-2026-34603

Path Traversal in Ssw Tinacms\/Cli ≤ 2.2.1

Published
01 April 2026
Modified
07 April 2026
Patch / advisory
CVSS Score v3.1 7.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0041 34th percentile
Risk Priority 53 floored blend · peak EPSS

Summary

CVE-2026-34603 is a high-severity Path Traversal (CWE-22) vulnerability in Ssw Tinacms\/Cli. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-34603 is a path traversal vulnerability (CWE-22, CWE-59) in the @tinacms/cli component of Tina, a headless content management system. Prior to version 2.2.2, lexical path-traversal checks were added to the dev media routes, but these only validate the path string without resolving symlink or junction targets. If a symlink or junction already exists under the media root, Tina treats paths like "pivot/written-from-media.txt" as valid within the media directory, enabling real filesystem operations through the link target. This affects media listing, write, and delete operations, with a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

An attacker with low privileges (PR:L) can exploit this over the network (AV:N), though it requires high attack complexity (AC:H) such as pre-existing symlinks or junctions under the media root. No user interaction is needed (UI:N). Successful exploitation grants high confidentiality impact via out-of-root media listing, high integrity impact through arbitrary write and delete operations outside the intended media directory, and low availability impact.

The issue is addressed in Tina version 2.2.2, as detailed in the GitHub security advisory (GHSA-g87c-r2jp-293w) and the patching commit (f124eabaca10dac9a4d765c9e4135813c4830955). Security practitioners should upgrade to version 2.2.2 or later to mitigate the vulnerability.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If…

more

a link already exists under the media root, Tina accepts a path like pivot/written-from-media.txt as "inside" the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete. This issue has been patched in version 2.2.2.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1034 Path Interception Persistence
**This technique has been deprecated.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1547.009 Shortcut Modification Persistence
Adversaries may create or modify shortcuts that can execute a program during system boot or user login.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-28793Same product: Ssw Tinacms\/Cli
CVE-2026-28791Same product: Ssw Tinacms\/Cli
CVE-2026-28792Same product: Ssw Tinacms\/Cli
CVE-2026-34604Same vendor: Ssw
CVE-2026-24125Same vendor: Ssw
CVE-2026-24046Shared CWE-22, CWE-59
CVE-2026-44340Shared CWE-22, CWE-59
CVE-2026-47277Shared CWE-22, CWE-59
CVE-2022-21999Shared CWE-22, CWE-59
CVE-2026-33001Shared CWE-22, CWE-59

Affected Assets

ssw
tinacms\/cli
≤ 2.2.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.3.2
  • V15.4.2

Mitigating Controls (NIST 800-53 r5) AI

Enforces the intended directory access authorizations that path traversal would otherwise bypass.

Input validation directly neutralizes special path elements before pathname construction occurs.

Least privilege reduces the impact of any unauthorized file access obtained via traversal.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require code to validate paths and avoid unsafe link following.

PR.PS-02 partial match
prevents

Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.

PR.AA-05 none match
prevents

PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development catches path traversal via static/dynamic analysis.

prevents

Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.

prevents

Application security requirements include rules for safe file handling and canonicalization.

prevents

Secure architecture principles require least-privilege file access and directory isolation.

prevents

Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.

mitigates

Information access restriction limits which files an application may read or write.

References