Dinky
Monthly
Path traversal in the catalogue upload endpoint of DataLinkDC Dinky through 1.2.5 lets an authenticated low-privilege user write files outside the intended upload directory by manipulating the path handled by CatalogueController.upload (dinky-admin). Because the flaw requires a valid account with access to the Catalogue Upload API (CVSS PR:L), it is a post-authentication integrity and availability risk rather than an unauthenticated entry point; no user interaction is needed and no non-default configuration is described. Severity is assessed at 5.3 (moderate, this_month priority), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis - the only exploitation reference is the researcher's GHSA advisory on the project repository.
Server-side request forgery in DataLinkDC Dinky up to and including 1.2.5 lets remote attackers make the server issue requests to attacker-chosen destinations through the 'connectAddress' argument of SqlGateway.onOpen in the sql-gateway endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the assessed conditions show exploitation only requires reaching the sql-gateway endpoint and invoking that function, although the sources do not document access control on the endpoint, so whether it is unauthenticated in default deployments is unverified; scored impact is low (VC:L/VI:L/VA:L), consistent with internal reconnaissance or reaching restricted resources rather than code execution. An exploit disclosure is public according to the reporting sources and CVSS 4.0 exploit maturity is rated P, but the PoC is not independently verified as working exploit code and no active exploitation (CISA KEV) is reported.
Path traversal in DataLinkDC Dinky through 1.2.5 lets a low-privileged authenticated user manipulate the filename argument handled by file.getOriginalFilename in CatalogueController.java's Catalogue Upload component, reaching locations outside the intended upload path with low integrity and availability impact and no confidentiality loss. The flaw is network-reachable without user interaction (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/E:P; assessed CVSS 3.1 base 3.1), and a published exploit reference exists, though the authentication prerequisite and bounded impact keep the priority label at monitor rather than act_now.
Server-side request forgery in DataLinkDC Dinky through version 1.2.5 lets a remote, unauthenticated attacker control the destination of requests relayed through the flink_web proxy endpoint by manipulating the _authority argument processed by FlinkWebURITemplateProxyServlet.getNewTargetUri. Successful abuse lets the Dinky server be used as a pivot to reach and probe internal services that are not otherwise exposed, with low confidentiality, integrity and availability impact and no scope change to downstream systems. The reporting source (VulDB) states that exploit code has been published and may be used - reflected in the CVSS 4.0 E:P metric - but there is no CISA KEV entry confirming active exploitation, and the vendor has not published a fixed version in the available data.
Dinky versions up to 1.2.5 contain an authentication bypass in the OpenAPI endpoint handler that allows unauthenticated remote attackers to manipulate interceptor configuration. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.
Server-side request forgery in Dinky up to version 1.2.5 allows authenticated attackers to make arbitrary HTTP requests through the Flink Proxy Controller's proxyUba function. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. An attacker with valid credentials can leverage this to access internal resources or perform actions on behalf of the affected server.
Path traversal in Dinky up to version 1.2.5 allows authenticated remote attackers to access arbitrary files on the system through manipulation of the projectName parameter in the GitRepository component. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with valid credentials can exploit this to read sensitive files or potentially escalate privileges within Java-based Dinky deployments.
Path traversal in the catalogue upload endpoint of DataLinkDC Dinky through 1.2.5 lets an authenticated low-privilege user write files outside the intended upload directory by manipulating the path handled by CatalogueController.upload (dinky-admin). Because the flaw requires a valid account with access to the Catalogue Upload API (CVSS PR:L), it is a post-authentication integrity and availability risk rather than an unauthenticated entry point; no user interaction is needed and no non-default configuration is described. Severity is assessed at 5.3 (moderate, this_month priority), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis - the only exploitation reference is the researcher's GHSA advisory on the project repository.
Server-side request forgery in DataLinkDC Dinky up to and including 1.2.5 lets remote attackers make the server issue requests to attacker-chosen destinations through the 'connectAddress' argument of SqlGateway.onOpen in the sql-gateway endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the assessed conditions show exploitation only requires reaching the sql-gateway endpoint and invoking that function, although the sources do not document access control on the endpoint, so whether it is unauthenticated in default deployments is unverified; scored impact is low (VC:L/VI:L/VA:L), consistent with internal reconnaissance or reaching restricted resources rather than code execution. An exploit disclosure is public according to the reporting sources and CVSS 4.0 exploit maturity is rated P, but the PoC is not independently verified as working exploit code and no active exploitation (CISA KEV) is reported.
Path traversal in DataLinkDC Dinky through 1.2.5 lets a low-privileged authenticated user manipulate the filename argument handled by file.getOriginalFilename in CatalogueController.java's Catalogue Upload component, reaching locations outside the intended upload path with low integrity and availability impact and no confidentiality loss. The flaw is network-reachable without user interaction (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/E:P; assessed CVSS 3.1 base 3.1), and a published exploit reference exists, though the authentication prerequisite and bounded impact keep the priority label at monitor rather than act_now.
Server-side request forgery in DataLinkDC Dinky through version 1.2.5 lets a remote, unauthenticated attacker control the destination of requests relayed through the flink_web proxy endpoint by manipulating the _authority argument processed by FlinkWebURITemplateProxyServlet.getNewTargetUri. Successful abuse lets the Dinky server be used as a pivot to reach and probe internal services that are not otherwise exposed, with low confidentiality, integrity and availability impact and no scope change to downstream systems. The reporting source (VulDB) states that exploit code has been published and may be used - reflected in the CVSS 4.0 E:P metric - but there is no CISA KEV entry confirming active exploitation, and the vendor has not published a fixed version in the available data.
Dinky versions up to 1.2.5 contain an authentication bypass in the OpenAPI endpoint handler that allows unauthenticated remote attackers to manipulate interceptor configuration. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.
Server-side request forgery in Dinky up to version 1.2.5 allows authenticated attackers to make arbitrary HTTP requests through the Flink Proxy Controller's proxyUba function. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. An attacker with valid credentials can leverage this to access internal resources or perform actions on behalf of the affected server.
Path traversal in Dinky up to version 1.2.5 allows authenticated remote attackers to access arbitrary files on the system through manipulation of the projectName parameter in the GitRepository component. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with valid credentials can exploit this to read sensitive files or potentially escalate privileges within Java-based Dinky deployments.