PT-2026-27207 · Blinko · Blinko

Tx1Ee · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-23484

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.3

Description The fileName parameter in Blinko is not properly filtered, which allows for path traversal. This enables unauthorized writing of files to any location within the file system. The affected interface only requires standard user authentication (authProcedure) and does not enforce super administrator authentication (superAdminAuthMiddleware).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-23484

GHSA-7V3F-V6VF-JM9Q

Produtos afetados

Blinko

Referências · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23484.json · Exploit
• https://github.com/blinkospace/blinko/security/advisories/GHSA-7v3f-v6vf-jm9q · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-23484 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23484 · Nota de Segurança