Path traversal in DataLinkDC Dinky catalogue upload
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
DataLinkDC Dinky versions 1.2.0 through 1.2.5 contain a path traversal flaw in the catalogue upload component. Manipulating the filename argument handled by the file.getOriginalFilename function in CatalogueController.java lets attackers reach paths outside the intended directory (CWE-22). A remote attacker with low privileges can exploit it, with low impact on integrity and availability. A public exploit has been published.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DataLinkDC | Dinky | 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5 | — | No fix listed | CNA |
- Dinky VendorDataLinkDC Affected 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for Dinky.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Timeline
- 2026-11-08 Threatist record created from CVE-2026-124326
- 2026-11-08 Alias added: GHSA-25h5-x769-924v
References
More DataLinkDC vulnerabilities
- TI-2026-02637 DataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication CVSS 4.0MEDIUM 6.9
- TI-2026-02636 DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery CVSS 4.0MEDIUM 5.3
- TI-2026-02635 DataLinkDC dinky Project Name GitRepository.java getProjectDir path traversal CVSS 4.0MEDIUM 5.3
- TI-2026-49279 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token CVSS 4.0CRITICAL 9.3
- TI-2026-49280 Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll CVSS 4.0HIGH 8.7
- TI-2026-85167 Server-side request forgery in DataLinkDC Dinky flink_web proxy CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-124326 · CVE Program
- CVE-2026-124326 · NVD
- GHSA-25h5-x769-924v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences