What is the CVSS score of CVE-2026-23485?

CVE-2026-23485 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Blinko are affected by CVE-2026-23485?

Organizations using Blinko should be aware of moderate risk from CVE-2026-23485, a path traversal vulnerability rated CVSS 5.3. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2026-23485?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Blinko CVE-2026-23485

EUVD-2026-14539 MEDIUM

Path Traversal (CWE-22)

2026-03-23 GitHub_M

Path Traversal Blinko Blinkospace

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.4

EUVD ID Assigned

Mar 23, 2026 - 21:00 euvd

EUVD-2026-14539

Analysis Generated

Mar 23, 2026 - 21:00 vuln.today

CVE Published

Mar 23, 2026 - 20:50 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4.

AnalysisAI

Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in the filePath parameter that allows unauthenticated remote attackers to enumerate file existence on the server through differential error responses. Versions prior to 1.8.4 are affected, and an attacker can leverage this vulnerability to discover sensitive files and directories without authentication or user interaction. The vulnerability has been patched in version 1.8.4, and exploit code or proof-of-concept demonstrations are available via the GitHub security advisory.

Technical ContextAI

The vulnerability stems from improper input validation of the filePath parameter, which fails to sanitize path traversal sequences such as '../' before processing file operations. This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and represents a common weakness in web applications that accept user-supplied file paths without adequate canonicalization or validation. Blinko (cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:*) implements file-based operations as part of its note-taking functionality, and the application fails to restrict access to files within intended directories. The error response differentiation (such as 'file not found' versus 'permission denied' versus 'access error') allows attackers to infer file system structure without actually reading file contents, making this a reconnaissance vulnerability with high confidence in enumeration results.

RemediationAI

Upgrade Blinko to version 1.8.4 or later immediately by downloading the patched release from https://github.com/blinkospace/blinko/releases/tag/1.8.4. The fix is available in commit 9d6fa80a3e11a99886f90e048657443335fd3e7d and has been verified through the official GitHub Security Advisory at https://github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7q. If immediate patching is not feasible, restrict network access to the Blinko service via firewall rules or reverse proxy configuration, limit exposure to trusted internal networks only, and disable public internet access until patching is completed. Monitor application logs for suspicious filePath parameter usage patterns that may indicate reconnaissance attempts.