DataLinkDC Dinky CVE-2026-124572

Exploitation requires an authenticated low-privilege account (CVSS PR:L) with access to the Catalogue Upload API endpoint backed by CatalogueController.upload in dinky-admin; the attacker must be able to reach the Dinky web application over the network (AV:N). The limiting factor is the authentication requirement - this is not an unauthenticated flaw, so an attacker needs valid credentials or an existing session on the Dinky instance. Affected versions are DataLinkDC Dinky up to and including 1.2.5. No user interaction is required (UI:N), and the input does not describe any non-default configuration being necessary; the precise filesystem trigger (how the traversal path is parsed) is not detailed in the available sources.

This is a moderate-priority issue that does not rise to emergency status. The CVSS 4.0 base score is 5.3 (medium), reflecting a path traversal (CWE-22) reachable over the network (AV:N) with low attack complexity (AC:L) but requiring low-privilege authentication (PR:L) and no user interaction (UI:N); impact is limited to partial integrity and availability (VI:L/VA:L) with no confidentiality impact (VC:N). The vuln.today decision label is 'this_month,' consistent with a non-urgent but worth-patching finding. There is no CISA KEV listing, so this is NOT confirmed actively exploited, and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. A GHSA security advisory (GHSA-vqj5-2vxg-f4mq) is referenced on the project repository, but the input does not confirm working exploit code - it is an advisory, not a verified PoC. The signals are internally consistent (medium severity, authenticated access required, limited impact, no active-exploitation evidence), so this reads as a genuine-but-contained vulnerability rather than a high-urgency threat. EPSS is missing and should be checked to refine prioritization.

An attacker who already holds a low-privilege authenticated account on a Dinky instance sends a crafted request to the Catalogue Upload API (CatalogueController.upload) with a manipulated file path containing traversal sequences. Because the path is not properly constrained, the upload is written outside the intended directory, letting the attacker overwrite or place files in unintended locations. No public, verified working exploit is confirmed in the input, though a GHSA advisory for the issue is referenced.