Path Injection Vulnerability in Dinky by DataLinkDC
CVE-2026-70558

9.3CRITICAL

Key Information:

Vendor

Datalinkdc

Status
Dinky
Vendor
CVE Published:
6 August 2026

What is CVE-2026-70558?

The Dinky application has a significant vulnerability where the POST /download/uploadFromRsByLocal handler does not sufficiently validate the caller-supplied path parameter. This absence of validation allows attackers to manipulate file paths and write arbitrary files using the Dinky service account. The exploitation of this vulnerability is facilitated by a hardcoded token, which is shared across all deployments, and the configuration of the default Docker image, which exposes the application on port 8888 without any authentication. Attackers can overwrite critical files, such as the static assets or even core class files, leading to the execution of malicious code in the context of the Dinky service account. This vulnerability affects Dinky v1.2.5 and has been reported in both the current release and development branches.

Affected Version(s)

Dinky 0 <= 1.2.5

References

https://github.com/DataLinkDC/dinky
product
https://github.com/DataLinkDC/dinky/issues/4566
technical-description
https://github.com/DataLinkDC/dinky/security/advisories/G...
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Asadbek Fatullayev
.