Path Traversal Vulnerability in DataLinkDC Dinky by DataLinkDC
CVE-2026-124326

5.3MEDIUM

Key Information:

Vendor

Datalinkdc

Status
Dinky
Vendor
CVE Published:
8 November 2026

What is CVE-2026-124326?

A path traversal vulnerability exists in DataLinkDC Dinky versions up to 1.2.5, specifically in the file.getOriginalFilename function within the CatalogueController.java file. This flaw allows an attacker to manipulate the filename argument, leading to unauthorized access to sensitive directories and files. The vulnerability can be exploited remotely, increasing the risk of attack on systems that utilize this component. The issue has been documented, and necessary mitigations should be applied to protect affected installations.

Affected Version(s)

Dinky 1.2.0

Dinky 1.2.1

Dinky 1.2.2

References

https://vuldb.com/vuln/432647
vdb-entrytechnical-description
https://vuldb.com/vuln/432647/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124326
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
VulDB CNA Team
.