Blinko EUVD-2026-14533

Blinko versions prior to 1.8.4. Remote unauthenticated attacker can exploit the unprotected temp/ endpoint via path traversal. If scheduled backup tasks are enabled, attackers can read backup files containing user notes and authentication tokens. Default installations are vulnerable.

This vulnerability presents critical real-world risk due to multiple compounding factors. While CVSS and EPSS scores are not provided in the intelligence data, the attack vector is clearly network-based with low complexity and requires no privileges, indicating high exploitability. The technical impact is severe: unauthorized information disclosure of user notes, authentication tokens, and potentially all backed-up user data. The presence of a public GitHub security advisory (GHSA-hrwx-rhrx-f9mm), confirmed fix commit (c48851090767feba431418630c495d90a7da1781), and released patch version (1.8.4) indicate this is a recognized, documented vulnerability with proof-of-concept potential. The ability to extract authentication tokens elevates this from mere data theft to potential account takeover and lateral movement. This is not a theoretical high-CVSS issue but a practical, exploitable vulnerability affecting a note-taking application that processes sensitive user content.

An attacker without authentication sends an HTTP request to the Blinko file server endpoint using a path traversal payload such as /temp/../../../../etc/passwd or /temp/../../../../backup.tar.gz (if backups are stored in predictable locations). Due to the lack of path validation, the server returns the contents of the arbitrary file. If scheduled backups are enabled, the attacker can systematically enumerate backup files and extract them, gaining access to the complete database of user notes and session tokens. These tokens can then be used to impersonate legitimate users and access their accounts.