Directory Traversal Vulnerability in Blinko by BlinkoSpace
CVE-2026-108980
Key Information:
Badges
What is CVE-2026-108980?
The Blinko product through version 1.8.8 exposes a directory traversal vulnerability that allows authenticated users to overwrite critical startup files as root. This issue arises from the installation procedure for plugins, where an unsanitized user input is used to construct the file path. By using '../' sequences, a malicious actor can introduce plugins outside the intended directory, leading to the potential replacement of root-owned startup files. Given that the official Docker image runs with root permissions, this can enable attackers to execute arbitrary code with root privileges. Furthermore, the vulnerability may allow unauthorized account self-registration, increasing the risk of exploit.
Affected Version(s)
Blinko 0 <= 1.8.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.