What is the CVSS score of CVE-2026-23482?

CVE-2026-23482 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Blinko are affected by CVE-2026-23482?

Blinko versions prior to 1.8.4 contain a path traversal vulnerability allowing unauthenticated attackers to read arbitrary server files, including backup archives with sensitive user data and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-23482?

Yes, a public proof-of-concept exploit is available for CVE-2026-23482. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23482?

Within 24 hours: Identify all Blinko deployments and document current versions; disable scheduled backup tasks if feasible. Within 7 days: Apply vendor-released patch to Blinko version 1.8.4 or later on all instances; validate patch installation. Within 30 days: Conduct full audit of file access logs for the temp/ directory; rotate all authentication tokens and review for unauthorized access; if backup files were accessed, initiate breach notification per applicable regulations.

Blinko CVE-2026-23482

EUVD-2026-14533 HIGH

Path Traversal (CWE-22)

2026-03-23 GitHub_M

Path Traversal Blinko Blinkospace

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:18 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.4

EUVD ID Assigned

Mar 23, 2026 - 20:45 euvd

EUVD-2026-14533

Analysis Generated

Mar 23, 2026 - 20:45 vuln.today

CVE Published

Mar 23, 2026 - 20:25 nvd

HIGH 7.5

DescriptionGitHub Advisory

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks are enabled, attackers can read backup files to obtain all user notes and user TOKENS. This issue has been patched in version 1.8.4.

AnalysisAI

Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in its file server endpoint that fails to validate permissions on the temp/ directory and does not filter path traversal sequences (CWE-22). Attackers can exploit this to read arbitrary files on the server, and when scheduled backup tasks are enabled, can access backup files containing all user notes and authentication tokens. The vulnerability affects all versions prior to 1.8.4 and has been patched in the released version 1.8.4.

Technical ContextAI

The vulnerability exists in Blinko's file server endpoint (cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:*) which serves files from the temp/ directory without proper access control mechanisms or input sanitization. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw where an attacker can use sequences such as '../' to traverse the directory structure and access files outside the intended temp/ directory. The absence of both permission checks and path traversal sequence filtering means an unauthenticated attacker can directly manipulate file paths to reach sensitive system files, backup archives, and configuration files containing authentication credentials.

RemediationAI

Immediately upgrade Blinko to version 1.8.4 or later, as confirmed by the official release at https://github.com/blinkospace/blinko/releases/tag/1.8.4. This patch version includes fixes for both the missing permission checks and path traversal filtering in the file server endpoint. If immediate patching is not possible, disable scheduled backup tasks to prevent attackers from extracting backup files containing user tokens and notes, and implement network segmentation to restrict access to the Blinko application to trusted IP ranges only. Additionally, review server logs for any suspicious file access patterns using '../' sequences and rotate all user authentication tokens as a precautionary measure if the vulnerability may have been exploited.