CVE-2026-23483mediumCWE-22

CVE-2026-23483: falha de média gravidade em blinkospace blinko

Blinko: Unauthorized Arbitrary File Read - /plugins

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar blinko

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 6.9epss 0.8%
Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
blinkospace · blinko
CVEs relacionadas — blinkospace blinko

No mesmo produto, das mais perigosas para as menos.

CVE-2026-23482HIGHBlinko: Unauthorized Arbitrary File Read - /api/file/tempEPSS 1.5%CVE-2026-23486MEDIUMBlinko: Unauthorized User Information LeakEPSS 0.7%CVE-2026-85607HIGHBlinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC RouterEPSS 0.7%CVE-2026-85624HIGHBlinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceListEPSS 0.4%CVE-2026-23481MEDIUMBlinko: Authenticated Arbitrary File Write - saveAdditionalDevFileEPSS 0.4%CVE-2026-23882HIGHBlinko: Admin RCE - MCP Server Command InjectionEPSS 0.4%