PT-2026-21613 · Datalinkdc · Dinky

Ana10Gy · Published 2026-02-24 · Updated 2026-02-24 · CVE-2026-3051

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions DataLinkDC dinky versions up to 1.2.5

Description A path traversal issue exists in DataLinkDC dinky. The getProjectDir function within the file dinky-admin/src/main/java/org/dinky/utils/GitRepository.java of the Project Name Handler component is susceptible to manipulation of the projectName argument, leading to path traversal. This issue can be exploited remotely. The exploit details have been publicly disclosed.

Recommendations Versions prior to 1.2.5 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3051

Affected Products

Dinky

References · 9

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/5 · Exploit
• 🔥 https://github.com/AnalogyC0de/public_exp/issues/5#issue-3935000629 · Exploit
• https://osv.dev/vulnerability/CVE-2026-3051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3051 · Security Note
• https://twitter.com/VulmonFeeds/status/2026176891606929643 · Twitter Post
• https://twitter.com/CVEnew/status/2026184642693656649 · Twitter Post
• https://vuldb.com/?submit.757586 · Note
• https://vuldb.com/?ctiid.347409 · Note
• https://vuldb.com/?id.347409 · Note