Authenticated file access via unresolved media links

Path traversal in TinaCMS before 2.2.2 allows attackers to read, write, and delete files outside the configured media root. The dev media handlers validate path.resolve string containment, then pass accepted paths to readdir, createWriteStream, or remove without resolving link targets. Exploitation requires an existing symlink or junction beneath the media root and access to the media routes, enabling disclosure, modification, or deletion at the link destination.