Blinko CVE-2026-23483

While a formal CVSS score and EPSS probability are not provided, this vulnerability carries significant real-world risk. The attack vector is network-based (accessible via HTTP requests to the plugin endpoint), requires no authentication, and has low complexity—an attacker needs only to craft a URI with traversal sequences. The technical impact is severe: arbitrary file read access can expose sensitive configuration files, private keys, source code, and user data. The absence of a public patch at the time of disclosure is a critical risk signal, meaning all deployed instances remain vulnerable indefinitely without vendor action. The fact that no CVSS/EPSS was assigned does not diminish the threat; rather, it suggests the vulnerability may have been reserved or delayed in publication. KEV status is unknown from the provided data, but the simplicity of exploitation (no special tools required) and the high impact (information disclosure) classify this as a high-priority vulnerability regardless of CVSS metrics.

An attacker on the network sends an HTTP GET request to the Blinko plugin endpoint with a crafted path such as '/plugins/../../../../../../etc/passwd' or uses URL-encoded traversal sequences to bypass simple string matching. The vulnerable endpoint joins this attacker-controlled path with the base plugins directory using join() without validation, resolving to an absolute path outside the plugins directory. The server then reads and returns the requested file (e.g., /etc/passwd, application configuration files, or private keys) directly in the HTTP response. No authentication is required, and the attack can be automated to enumerate the filesystem and exfiltrate sensitive data.