CVE-2026-23483mediumCWE-22

CVE-2026-23483: fallo de gravedad media en blinkospace blinko

Blinko: Unauthorized Arbitrary File Read - /plugins

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear blinko

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 6.9epss 0.8%
Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
blinkospace · blinko
CVEs relacionadas — blinkospace blinko

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-23482HIGHBlinko: Unauthorized Arbitrary File Read - /api/file/tempEPSS 1.5%CVE-2026-23486MEDIUMBlinko: Unauthorized User Information LeakEPSS 0.7%CVE-2026-85607HIGHBlinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC RouterEPSS 0.7%CVE-2026-85624HIGHBlinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceListEPSS 0.4%CVE-2026-23481MEDIUMBlinko: Authenticated Arbitrary File Write - saveAdditionalDevFileEPSS 0.4%CVE-2026-23882HIGHBlinko: Admin RCE - MCP Server Command InjectionEPSS 0.4%