Microsoft CVE-2026-34603

Requires authenticated user access to @tinacms/cli dev media routes. Attacker must have low privilege (PR:L) and a symlink or junction must already exist under the media root directory. No user interaction needed. Affects default configurations where symlink validation is not implemented.

CVSS 7.1 (High) reflects network-accessible attack vector with high attack complexity, low privileges required, and high confidentiality/integrity impact with low availability impact. The AC:H rating is critical-exploitation requires an attacker to first create or influence a symlink/junction within the media directory, which typically requires filesystem access or social engineering in repository workflows. PR:L indicates authenticated access to TinaCMS dev server is required. Real-world risk is elevated primarily in development and self-hosted scenarios where symlinks may exist legitimately in media directories (e.g., linking to external asset stores) or where attackers have limited filesystem access to plant junctions. The impact is genuine-confirmed arbitrary file read/write outside media root-but the prerequisite conditions limit widespread exploitability. EPSS probability not provided for risk calibration. No CISA KEV listing or public weaponization identified, suggesting limited active targeting. SSVC factors: exploitation status is POC (researcher demonstrated local Windows junction); automatable is NO due to symlink prerequisite; technical impact is TOTAL (arbitrary file operations). Priority is MEDIUM for dev environments with symlinks, LOW for production deployments without user-controlled filesystem state. This is a legitimate high-severity issue in affected configurations but not an emergency patch requiring immediate universal deployment.

An attacker with low-privilege authenticated access to a TinaCMS development server first creates a Windows junction or symlink named 'pivot' under the media uploads directory, pointing to a sensitive directory like /etc or C:\Windows\System32. They then send a GET request to /media/list/pivot which passes path validation because 'pivot' resolves lexically within the media root, but Node.js readdir follows the junction and returns a directory listing of the external target, leaking sensitive filesystem structure. The attacker escalates by POST uploading a malicious file to /media/upload/pivot/malicious.exe, which TinaCMS writes through the junction to the system directory, achieving arbitrary file write outside the media sandbox. The researcher's Windows proof-of-concept demonstrates this pattern with a junction linking public/uploads/pivot to an outside directory, successfully writing 'MEDIA_ESCAPE' content to outside/written-from-media.txt. No public exploit identified at time of analysis beyond the researcher's local demonstration.