Skip to content
Sign in
5.3 Medium

CVE-2026-124326 DataLinkDC Dinky Catalogue Upload CatalogueController.java file.getOriginalFilename path traversal

Description

A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
Low
Interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
Dinky 1.2 1.2.0 → 1.2.5 No fix stated

Other CVEs of Dinky

The 7 CVEs of Dinky →
CVE-2026-122009 DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery 6.9 Medium CVE-2026-70559 Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation… 7.5 High CVE-2026-70558 Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new… 9.8 Critical CVE-2026-3053 A vulnerability was determined in DataLinkDC dinky up to 1.2.5 6.9 Medium
Track this CVE