https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-34604.htmlhttps://patchthecve.com/cve/CVE-2026-34604.htmlWed, 17 Jun 2026 10:39:18 +0000HIGH 7.1: Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed content rhttps://patchthecve.com/cve/CVE-2026-34603.htmlhttps://patchthecve.com/cve/CVE-2026-34603.htmlWed, 17 Jun 2026 10:39:18 +0000HIGH 7.1: Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the mehttps://patchthecve.com/cve/CVE-2026-33949.htmlhttps://patchthecve.com/cve/CVE-2026-33949.htmlWed, 17 Jun 2026 10:38:21 +0000HIGH 8.1: Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The