What is the CVSS score of CVE-2026-23484?

CVE-2026-23484 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Blinko are affected by CVE-2026-23484?

Organizations using Blinko should be aware of notable risk from CVE-2026-23484, a path traversal vulnerability rated CVSS 6.5. This could allow unauthorized file access.

How to fix or mitigate CVE-2026-23484?

Within 30 days: Identify affected systems running versions from 1.8.3 and and apply vendor patches as part of regular patch cycle. Review file handling controls.

Blinko CVE-2026-23484

EUVD-2026-14538 MEDIUM

Path Traversal (CWE-22)

2026-03-23 GitHub_M

Path Traversal Blinko Blinkospace

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 20:45 euvd

EUVD-2026-14538

Analysis Generated

Mar 23, 2026 - 20:45 vuln.today

CVE Published

Mar 23, 2026 - 20:31 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the fileName parameter is not filtered, allowing path traversal to write files anywhere on the file system. Moreover, this interface only requires authProcedure (normal user), not superAdminAuthMiddleware. At time of publication, there are no publicly available patches.

AnalysisAI

Blinko versions 1.8.3 and earlier allow authenticated users to write arbitrary files to the filesystem through an unvalidated fileName parameter, exploiting a path traversal weakness. The vulnerability requires only basic user authentication and can be leveraged to place malicious files anywhere on the server, potentially leading to remote code execution or system compromise. No patch is currently available.

Technical ContextAI

Blinko is identified via CPE as cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:*, a Node.js-based AI-powered note-taking application. The vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, aka 'Path Traversal'), which occurs when user-supplied input in the fileName parameter is not sanitized before being used in file system operations. The application likely uses this parameter directly in file write operations without stripping directory traversal sequences such as '../' or absolute path specifiers. The authentication bypass aspect—where the vulnerable endpoint only checks authProcedure rather than superAdminAuthMiddleware—indicates a second-order flaw in the authorization logic, allowing any authenticated user (even low-privileged ones) to trigger the path traversal vulnerability.

RemediationAI

At the time of this analysis, no official patch is available from the Blinko project. Organizations should monitor the GitHub Security Advisory at https://github.com/blinkospace/blinko/security/advisories/GHSA-7v3f-v6vf-jm9q for patch availability and upgrade immediately upon release. As an interim mitigation, restrict network access to Blinko instances to trusted IP ranges, enforce authentication with strong credentials, implement file system permissions to limit write access from the Blinko application process to only necessary directories, and consider deploying a Web Application Firewall (WAF) with rules to detect and block path traversal patterns (e.g., requests containing '../' or absolute paths in the fileName parameter). Do not rely solely on application-level controls; defense-in-depth approaches combining network segmentation, least-privilege file system permissions, and access logging are essential until a patch is released.