PT-2026-27206 · Blinko · Blinko

Tx1Ee · Published 2026-03-23 · Updated 2026-04-30 · CVE-2026-23483

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.3

Description Blinko is an AI-powered card note-taking project. The plugin file server endpoint uses the join() function to concatenate paths but does not verify if the final path is within the plugins directory, leading to a path traversal issue. The vulnerable API endpoint is the plugin file server endpoint. The join() function is used to concatenate paths without proper validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-23483

GHSA-54C7-9GXH-FG9V

Affected Products

Blinko

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23483.json · Exploit
• https://github.com/blinkospace/blinko/security/advisories/GHSA-54c7-9gxh-fg9v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23483 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23483 · Vendor Advisory
• https://twitter.com/pdnuclei_bot/status/2049775798043996353 · Twitter Post