Path traversal in DataLinkDC dinky Catalogue Upload API
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
DataLinkDC dinky up to and including 1.2.5 contains a path traversal flaw in the Catalogue Upload API, in the CatalogueController.upload function. Improper limitation of a pathname to a restricted directory (CWE-22) lets a remote attacker with low privileges reach locations outside the intended directory. The attack has low impact on integrity and availability.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DataLinkDC | dinky | 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5 | — | No fix listed | CNA |
- dinky VendorDataLinkDC Affected 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for dinky.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Timeline
- 2026-11-09 Threatist record created from CVE-2026-124572
References
More DataLinkDC vulnerabilities
- TI-2026-02637 DataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication CVSS 4.0MEDIUM 6.9
- TI-2026-02636 DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery CVSS 4.0MEDIUM 5.3
- TI-2026-02635 DataLinkDC dinky Project Name GitRepository.java getProjectDir path traversal CVSS 4.0MEDIUM 5.3
- TI-2026-49279 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token CVSS 4.0CRITICAL 9.3
- TI-2026-49280 Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll CVSS 4.0HIGH 8.7
- TI-2026-85167 Server-side request forgery in DataLinkDC Dinky flink_web proxy CVSS 4.0MEDIUM 6.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences