CVE-2026-23485
MEDIUMBlinko: Unauthorized Path Traversal File Enumeration - music-metadata
Title source: cnaDescription
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7q
X_Refsource_Misc x_refsource_misc
https://github.com/blinkospace/blinko/commit/9d6fa80a3e11a99886f90e048657443335fd3e7d
X_Refsource_Misc x_refsource_misc
https://github.com/blinkospace/blinko/releases/tag/1.8.4
Scores
CVSS v3
5.3
EPSS
0.0030
EPSS Percentile
21.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (2)
blinko/blinko
< 1.8.4
blinkospace/blinko
< 1.8.4
Published
Mar 23, 2026
Tracked Since
Mar 24, 2026