{"id":"CVE-2026-124326","kind":"vulnerability","aliases":["CVE-2026-124326"],"related":[],"title":"Dinky: catalogue upload filename lets attackers write files outside target folder","description":"A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.","summary":"DataLinkDC Dinky up to 1.2.5 fails to sanitize the filename of uploaded catalogue files in CatalogueController.java. A remote attacker can use path traversal sequences in the filename to place files outside the intended directory.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dinky","java","package","self-hosted"],"not_affected_if":["upload-endpoint-blocked"],"how_to_check":"- Check the installed Dinky version against 1.2.5 and earlier.\n- Look for the Catalogue Upload feature in the deployed Dinky instance and confirm whether it is reachable from outside your network.","fix":null,"status":"open","published_at":"2026-11-08T10:16:51+00:00","first_seen_at":"2026-11-08T10:47:22+00:00","triaged_at":"2026-11-08T10:48:38+00:00","updated_at":"2026-11-08T10:48:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T10:48:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dinky: catalogue upload filename lets attackers write files outside target folder","impact":"high","summary":"DataLinkDC Dinky up to 1.2.5 fails to sanitize the filename of uploaded catalogue files in CatalogueController.java. A remote attacker can use path traversal sequences in the filename to place files outside the intended directory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dinky","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker writes files to arbitrary server paths","analyst_note":"Check the GHSA referenced in the NVD entry and the vendor advisory for the fixed version and whether login is required before the upload runs.","how_to_check":"- Check the installed Dinky version against 1.2.5 and earlier.\n- Look for the Catalogue Upload feature in the deployed Dinky instance and confirm whether it is reachable from outside your network.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["upload-endpoint-blocked"],"who_is_affected":"Teams running a self-hosted Dinky instance (a Flink SQL development platform) up to version 1.2.5 where the catalogue upload feature is reachable. The sources do not say whether authentication is required or whether the feature is on by default. Teams on newer releases or with the upload endpoint blocked from users can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4596,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124326':14A,17A '-2026':13A,16A '1.2.5':28B,68C 'argument':88C 'attack':6A,42B,96C 'catalogu':2A,36B,81C 'cataloguecontroller.java':39B,77C 'claim':112C 'compon':80C 'cve':12A,15A 'datalinkdc':24B,64C 'dinki':1A,18B,25B,65C 'directori':57B 'execut':83C,99C 'exploit':102C 'fail':29B 'file':8A,37B,53B,76C 'file.getoriginalfilename':73C 'filenam':4A,33B,50B,89C 'flaw':59C 'folder':11A 'found':62C 'function':72C 'ghsa':117C 'host':23B 'impact':69C 'intend':56B 'java':19B 'lead':91C 'let':5A 'manipul':85C 'may':107C 'outsid':9A,54B 'packag':20B 'path':45B,93C 'place':52B 'project':123C 'publish':105C 'remot':41B,100C 'repositori':120C 'research':111C 'sanit':31B 'self':22B 'self-host':21B 'sequenc':47B 'submit':115C 'target':10A 'travers':46B,94C 'upload':3A,35B,82C 'use':44B,109C 'write':7A","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Dinky instance (a Flink SQL development platform) up to version 1.2.5 where the catalogue upload feature is reachable. The sources do not say whether authentication is required or whether the feature is on by default. Teams on newer releases or with the upload endpoint blocked from users can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dinky","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124326':14A,17A '-2026':13A,16A 'attack':6A 'catalogu':2A 'cve':12A,15A 'dinki':1A 'file':8A 'filenam':4A 'folder':11A 'let':5A 'outsid':9A 'target':10A 'upload':3A 'write':7A","search_b":"'1.2.5':28B 'attack':42B 'catalogu':36B 'cataloguecontroller.java':39B 'datalinkdc':24B 'dinki':18B,25B 'directori':57B 'fail':29B 'file':37B,53B 'filenam':33B,50B 'host':23B 'intend':56B 'java':19B 'outsid':54B 'packag':20B 'path':45B 'place':52B 'remot':41B 'sanit':31B 'self':22B 'self-host':21B 'sequenc':47B 'travers':46B 'upload':35B 'use':44B","search_c":"'1.2.5':68C 'argument':88C 'attack':96C 'catalogu':81C 'cataloguecontroller.java':77C 'claim':112C 'compon':80C 'datalinkdc':64C 'dinki':65C 'execut':83C,99C 'exploit':102C 'file':76C 'file.getoriginalfilename':73C 'filenam':89C 'flaw':59C 'found':62C 'function':72C 'ghsa':117C 'impact':69C 'lead':91C 'manipul':85C 'may':107C 'path':93C 'project':123C 'publish':105C 'remot':100C 'repositori':120C 'research':111C 'submit':115C 'travers':94C 'upload':82C 'use':109C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T10:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124326","severity":null,"published_at":"2026-11-08T10:16:51+00:00","modified_at":"2026-11-08T10:16:52+00:00","first_seen_at":"2026-11-08T10:47:22+00:00","fetched_at":"2026-11-08T10:47:22+00:00","note":null}],"documents":[{"id":101172,"url":"https://github.com/DataLinkDC/dinky/security/advisories/GHSA-2jp7-3h24-h6r7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}