CVE-2026-124326 · Package
NO FIX YET
DataLinkDC Dinky up to 1.2.5 fails to sanitize the filename of uploaded catalogue files in CatalogueController.java. A remote attacker can use path traversal sequences in the filename to place files outside the intended directory.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a self-hosted Dinky instance (a Flink SQL development platform) up to version 1.2.5 where the catalogue upload feature is reachable. The sources do not say whether authentication is required or whether the feature is on by default. Teams on newer releases or with the upload endpoint blocked from users can skip it.
Not affected if upload-endpoint-blocked
Who cares dinky, java, self-hosted
No fix yet, per the sources.
A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.