EUVD-2026-14531Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an authenticated arbitrary file write vulnerability in saveAdditionalDevFile. This issue has been patched in version 1.8.4.
AnalysisAI
Blinko, an AI-powered card note-taking application, contains an authenticated arbitrary file write vulnerability in the saveAdditionalDevFile function that allows attackers to write files to arbitrary locations on the system via path traversal. This vulnerability affects all versions prior to 1.8.4 and requires authentication to exploit. An attacker with valid credentials can abuse this flaw to overwrite critical application files, inject malicious code, or achieve remote code execution depending on file permissions and system configuration.
Technical ContextAI
The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal). The saveAdditionalDevFile function in Blinko fails to properly sanitize user-supplied file paths before writing files to disk, allowing attackers to use path traversal sequences (such as ../ or absolute paths) to escape intended directory boundaries. This affects the Blinko product line as identified by CPE cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:* across all versions before 1.8.4. The vulnerability resides in application-level file handling code rather than a third-party library, making it a direct implementation flaw in Blinko's file management system.
RemediationAI
Upgrade Blinko to version 1.8.4 or later immediately. The patch is available at https://github.com/blinkospace/blinko/releases/tag/1.8.4, and the specific fix can be reviewed at commit 02a4205f1ad22d0e78dc2ab2967b551d0dbd0a06. Until patching is possible, restrict authentication to trusted users only, monitor file system access and modifications within the Blinko application directory for unexpected changes, and consider running Blinko in a sandboxed environment or container with restricted write permissions to limit the scope of exploitation. Implement file integrity monitoring on critical application configuration and executable files.
Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in its file server endpoint
A publicly accessible endpoint in Blinko prior to version 1.8.4 discloses sensitive user information including usernames
Blinko versions 1.8.3 and earlier contain a path traversal vulnerability in the plugin file server endpoint that fails t
Blinko versions prior to 1.8.4 contain a critical privilege escalation vulnerability in the upsertUser endpoint that all
Insecure Direct Object Reference (IDOR) in Blinko 1.8.7 allows any authenticated user to read, modify, and delete AI cha
Blinko versions prior to 1.8.4 allow authenticated high-privilege users to execute arbitrary commands through the MCP se
Cross-user private note disclosure in Blinko 1.8.7 allows any authenticated user to read other users' private notes, att
An Insecure Direct Object Reference (IDOR) vulnerability in Blinko versions prior to 1.8.4 allows authenticated attacker
Blinko versions 1.8.3 and earlier allow authenticated users to write arbitrary files to the filesystem through an unvali
Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in the filePath parameter th
Blinko, an AI-powered card note-taking application, contains an authentication bypass vulnerability in its comment manag
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today