Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Blinkospace |
|
No data.
No data.
References
History
Tue, 24 Mar 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Blinkospace
Blinkospace blinko |
|
| Vendors & Products |
Blinkospace
Blinkospace blinko |
Tue, 24 Mar 2026 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches. | |
| Title | Blinko: Unauthorized Arbitrary File Read - /plugins | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-03-23T20:28:55.541Z
Updated: 2026-03-23T20:28:55.541Z
Reserved: 2026-01-13T15:47:41.628Z
Link: CVE-2026-23483
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-23T21:17:02.547
Modified: 2026-03-23T21:17:02.547
Link: CVE-2026-23483
Redhat
No data.