Path Traversal Vulnerability in DataLinkDC dinky Catalogue Upload API

CVE-2026-124572

What is CVE-2026-124572?

A path traversal vulnerability has been identified in the DataLinkDC dinky Catalogue Upload API, particularly within the function CatalogueController.upload located in the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java. This flaw allows an attacker to manipulate file paths, potentially leading to unauthorized access to restricted files on the server. The vulnerability can be exploited remotely, posing a serious threat to the integrity of data and the security of the application. Researchers have indicated that a security advisory has been submitted in relation to this issue.

References