Blinko CVE-2026-23481

While CVSS scoring data is not provided, the vulnerability's real-world risk is elevated due to several factors: it requires authentication (reducing attack surface scope), but impacts the core file system integrity of the application. The existence of a public GitHub security advisory and patched commit indicates this was responsibly disclosed. No KEV status or EPSS score is available, but the presence of a fixed version (1.8.4) with a public commit hash (02a4205f1ad22d0e78dc2ab2967b551d0dbd0a06) suggests the vulnerability was actively verified. Organizations using Blinko in multi-tenant or collaborative environments should prioritize patching, as any authenticated user (including lower-privileged accounts) could exploit this to affect system stability or escalate privileges. The risk is moderate-to-high for deployments where untrusted users have authentication credentials.

An authenticated user with standard privileges in a multi-user Blinko instance submits a crafted file save request to saveAdditionalDevFile with a path traversal payload (e.g., ../../../etc/blinko/config.json or an absolute path to a system-critical file). The function fails to validate the path and writes attacker-controlled content to the specified location, potentially overwriting application configuration files to inject malicious settings, disable authentication, or execute arbitrary code on the next application restart. This is particularly impactful in scenarios where Blinko runs as a service account with elevated privileges.