What is the CVSS score of EUVD-2026-14535?

EUVD-2026-14535 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Blinko are affected by EUVD-2026-14535?

Organizations using Blinko should be aware of moderate risk from CVE-2026-23483, a path traversal vulnerability rated CVSS 5.3. This could allow unauthorized file access.

Is there a public PoC exploit available for EUVD-2026-14535?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14535. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14535?

Within 30 days: Identify affected systems running versions from 1.8.3 and and apply vendor patches as part of regular patch cycle. Review file handling controls.

Blinko EUVD-2026-14535

| CVE-2026-23483 MEDIUM

Path Traversal (CWE-22)

2026-03-23 GitHub_M

Path Traversal Blinko Blinkospace

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 20:45 euvd

EUVD-2026-14535

Analysis Generated

Mar 23, 2026 - 20:45 vuln.today

CVE Published

Mar 23, 2026 - 20:28 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches.

AnalysisAI

Blinko versions 1.8.3 and earlier contain a path traversal vulnerability in the plugin file server endpoint that fails to validate whether requested file paths remain within the plugins directory, enabling unauthenticated remote attackers to read arbitrary files. The vulnerability has a CVSS score of 5.3 and currently lacks a publicly available patch.

Technical ContextAI

Blinko is an AI-powered card note-taking application (CPE: cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:*) that includes a plugin file server endpoint. The vulnerability stems from improper path canonicalization in the path concatenation logic, which is a classic instance of CWE-22. The endpoint uses the join() function to combine user-supplied input with the base plugins directory path, but fails to perform post-join validation or canonicalization checks (such as realpath() or Path normalization) to ensure the resolved path remains within the intended plugins directory. This allows attackers to inject path traversal sequences like '../' to escape the plugins directory and access arbitrary files on the filesystem. The root cause reflects a common security antipattern where input validation occurs before normalization, allowing encoded or unusual traversal sequences to bypass checks.

RemediationAI

At the time of publication, no official patch is available from the vendor. The primary remediation is to monitor the GitHub Security Advisory (https://github.com/blinkospace/blinko/security/advisories/GHSA-54c7-9gxh-fg9v) for patch availability and upgrade immediately upon release. In the interim, implement network-level mitigations by restricting access to the Blinko instance using firewall rules or network segmentation to limit exposure to trusted internal networks only. Additionally, disable or restrict the plugin file server endpoint if it is not essential to operations, and consider running Blinko in an isolated environment with minimal filesystem permissions. Monitor filesystem access logs for suspicious activity patterns consistent with path traversal attempts (repeated '../' sequences in HTTP request logs).