Description
A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DataLinkDC | dinky | 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5 | — |
References
- VDB-432918 | DataLinkDC dinky Catalogue Upload API CatalogueController.java CatalogueController.upload path traversal vdb-entry technical-description
- VDB-432918 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-124572 | CVE Analysis and Report third-party-advisory
- Submit #1036005 | DataLinkDC Dinky <=1.2.5 Path Traversal in CatalogueController upload third-party-advisory
- https://github.com/DataLinkDC/dinky/security/advisories/GHSA-vqj5-2vxg-f4mq broken-link
- https://github.com/DataLinkDC/dinky/ product