PT-2026-27205 · Blinko · Blinko

Tx1Ee · Published 2026-03-23 · Updated 2026-04-30 · CVE-2026-23482

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.4

Description The file server endpoint does not validate permissions on the temp/ path and does not filter path traversal sequences, potentially allowing unauthorized access to arbitrary files on the server. If scheduled backup tasks are enabled, attackers may be able to read backup files containing user notes and user TOKENS. A path traversal attack exploits a flaw in an application's handling of user-supplied input, allowing attackers to access files and directories outside the intended root directory.

Recommendations Update to version 1.8.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-23482

GHSA-HRWX-RHRX-F9MM

Affected Products

Blinko

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23482.json · Exploit
• https://github.com/blinkospace/blinko/commit/c48851090767feba431418630c495d90a7da1781 · Patch
• https://github.com/blinkospace/blinko/security/advisories/GHSA-hrwx-rhrx-f9mm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23482 · Security Note
• https://github.com/blinkospace/blinko/releases/tag/1.8.4 · Note
• https://twitter.com/pdnuclei_bot/status/2049760703293374504 · Twitter Post