TI-2026-02637 CVE-2026-3053 · GHSA-w3pf-j6xr-fj68
DataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication
Priority HIGH 70
A vulnerability was determined in DataLinkDC dinky up to 1.2.5.
DataLinkDC
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
DataLinkDC records in CISA KEVNo DataLinkDC vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2026-02636 CVE-2026-3052 · GHSA-v2vh-hr2h-f29r
DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery
Priority MEDIUM 57
A vulnerability was found in DataLinkDC dinky up to 1.2.5.
TI-2026-02635 CVE-2026-3051 · GHSA-f256-j3x2-h7wh
DataLinkDC dinky Project Name GitRepository.java getProjectDir path traversal
Priority MEDIUM 57
A vulnerability has been found in DataLinkDC dinky up to 1.2.5.
TI-2026-49279 CVE-2026-70558 · GHSA-7crv-rq8j-wxc3
Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token
Priority MEDIUM 50
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path validation.
TI-2026-49280 CVE-2026-70559 · GHSA-83jg-x5rh-3x8c
Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll
Priority MEDIUM 44
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request throu…
TI-2026-85167 CVE-2026-122009 · GHSA-4fjq-hmwv-pfv4
Server-side request forgery in DataLinkDC Dinky flink_web proxy
Priority LOW 31
A flaw has been found in DataLinkDC Dinky up to 1.2.5.