PT-2026-27213 · Blinkospace · Blinko

Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-23485

NVD

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-23485

Affected Products

Blinko

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-23485 · Security Note
• https://github.com/blinkospace/blinko/commit/9d6fa80a3e11a99886f90e048657443335fd3e7d · Note
• https://github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7q · Note
• https://github.com/blinkospace/blinko/releases/tag/1.8.4 · Note