DataLinkDC Dinky CVE-2026-124326

Requires a network-reachable Dinky instance (up to 1.2.5) and a low-privileged authenticated account (PR:L), after which the attacker must reach the Catalogue Upload component and control the filename argument handled by file.getOriginalFilename in CatalogueController.java, injecting path-traversal sequences. Limiting factors: authentication is required (not exploitable by fully anonymous users), impact is bounded to low integrity/availability with no confidentiality loss per the vendor vector, and exploitation depends on the attacker reaching the catalogue upload functionality. No user interaction is needed (UI:N). The precise traversal primitive (write-only vs. read) is not fully detailed in the available sources beyond the impact metrics.

This is a low-priority issue despite being remotely reachable. The CVSS 4.0 base score is only 2.1 (Low), and the vector tells a consistent story: AV:N (network reachable) and AC:L (low complexity) are offset by PR:L, meaning the attacker must already hold a low-privileged authenticated account, and by minimal impact (VC:N, VI:L, VA:L - no confidentiality loss and only low integrity/availability impact). The vuln.today Decision label is 'monitor', the lowest urgency tier, which aligns with the low score. Exploit maturity is E:P (Proof-of-Concept), and the description states an exploit has been published and that a GHSA was submitted, so a public PoC reference exists - but it is not verified as working exploit code, and this is NOT confirmed active exploitation: the input shows no CISA KEV listing. No EPSS score is provided, so widespread-exploitation probability cannot be quantified from this data. Notably, for a CWE-22 path traversal one might expect confidentiality impact (file read), yet VulDB rated VC:N with only integrity/availability affected - this suggests the traversal is scoped to file placement/overwrite via the upload filename rather than arbitrary read; verify the exact primitive against the GHSA. Overall: a genuine but low-severity, authentication-gated flaw in a niche product - real enough to patch in normal cycles, not an emergency.

An attacker who already holds a low-privileged authenticated account on a Dinky instance uses the Catalogue Upload feature and supplies a crafted filename containing path-traversal sequences, which is processed by file.getOriginalFilename in CatalogueController.java without sanitization, causing the file to be written outside the intended directory. A public PoC reference exists (it is not verified as working exploit code), and the attack is network-reachable with low complexity, though the required authentication limits who can trigger it.