PT-2026-27205 · Blinko · Blinko

Tx1Ee · Publicado 2026-03-23 · Atualizado 2026-04-30 · CVE-2026-23482

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.4

Description The file server endpoint does not validate permissions on the temp/ path and does not filter path traversal sequences, potentially allowing unauthorized access to arbitrary files on the server. If scheduled backup tasks are enabled, attackers may be able to read backup files containing user notes and user TOKENS. A path traversal attack exploits a flaw in an application's handling of user-supplied input, allowing attackers to access files and directories outside the intended root directory.

Recommendations Update to version 1.8.4 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-23482

GHSA-HRWX-RHRX-F9MM

Produtos afetados

Blinko

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23482.json · Exploit
• https://github.com/blinkospace/blinko/releases/tag/1.8.4 · Nota
• https://github.com/blinkospace/blinko/commit/c48851090767feba431418630c495d90a7da1781 · Correção
• https://github.com/blinkospace/blinko/security/advisories/GHSA-hrwx-rhrx-f9mm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-23482 · Aviso do Fabricante
• https://twitter.com/pdnuclei_bot/status/2049760703293374504 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23482 · Nota de Segurança