Path Traversal Vulnerability in Blinko Note-Taking Application by BlinkoSpace
CVE-2026-23484

5.3MEDIUM

Key Information:

Vendor

Blinkospace

Status
Blinko
Vendor
CVE Published:
23 March 2026

What is CVE-2026-23484?

The Blinko note-taking application, developed by BlinkoSpace, exhibits a path traversal vulnerability due to insufficient filtering of the fileName parameter in versions up to 1.8.3. This flaw allows attackers to manipulate file paths, potentially leading to unauthorized file writing across the system. Additionally, the exposed interface only requires normal user authentication, bypassing the more secure superAdminAuthMiddleware. As of now, there are no publicly available patches to address this vulnerability.

Affected Version(s)

blinko <= 1.8.3

References

https://github.com/blinkospace/blinko/security/advisories...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.