PT-2026-27207 · Blinko · Blinko

Tx1Ee · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-23484

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.3

Description The fileName parameter in Blinko is not properly filtered, which allows for path traversal. This enables unauthorized writing of files to any location within the file system. The affected interface only requires standard user authentication (authProcedure) and does not enforce super administrator authentication (superAdminAuthMiddleware).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-23484

GHSA-7V3F-V6VF-JM9Q

Affected Products

Blinko

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23484.json · Exploit
• https://github.com/blinkospace/blinko/security/advisories/GHSA-7v3f-v6vf-jm9q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23484 · Security Note