{"action":"Upgrade @tinacms/graphql to 2.2.2 or later.","affected":[{"fixed":"2.2.2","introduced":"0"}],"component":"@tinacms/graphql","cve_ids":["CVE-2026-34603"],"ecosystem":"npm","epss":0.00424,"exploited":false,"fixed_versions":["2.2.2"],"ghsa_id":"GHSA-g87c-r2jp-293w","id":"tcs_01M5KFQZ60X1997NQ0ZD8YQGHR","modified_at":"2026-04-06T17:02:54.547895Z","published_at":"2026-04-01T00:23:02Z","references":["https://osv.dev/vulnerability/GHSA-g87c-r2jp-293w","https://github.com/tinacms/tinacms/security/advisories/GHSA-g87c-r2jp-293w","https://nvd.nist.gov/vuln/detail/CVE-2026-34603","https://github.com/tinacms/tinacms/commit/f124eabaca10dac9a4d765c9e4135813c4830955","https://github.com/tinacms/tinacms"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-g87c-r2jp-293w","url":"https://osv.dev/vulnerability/GHSA-g87c-r2jp-293w"}],"summary":"@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions"}