---
id: "CVE-2026-124326"
page: "https://infrastack.ai/live/CVE-2026-124326"
kind: "vulnerability"
aliases: ["CVE-2026-124326"]
title: "Dinky: catalogue upload filename lets attackers write files outside target folder"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dinky", "java", "package", "self-hosted"]
not_affected_if: ["upload-endpoint-blocked"]
published_at: "2026-11-08T10:16:51+00:00"
first_seen_at: "2026-11-08T10:47:22+00:00"
updated_at: "2026-11-08T10:48:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124326", "first_seen_at": "2026-11-08T10:47:22+00:00"}]
exploit_sources: []
---

# Dinky: catalogue upload filename lets attackers write files outside target folder

Link for people: https://infrastack.ai/live/CVE-2026-124326 (this .md is for agents)

DataLinkDC Dinky up to 1.2.5 fails to sanitize the filename of uploaded catalogue files in CatalogueController.java. A remote attacker can use path traversal sequences in the filename to place files outside the intended directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dinky version against 1.2.5 and earlier.
- Look for the Catalogue Upload feature in the deployed Dinky instance and confirm whether it is reachable from outside your network.

## Timeline

- 2026-11-08T10:47:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124326

## Documents

- [advisory] Vendor advisory: github.com https://github.com/DataLinkDC/dinky/security/advisories/GHSA-2jp7-3h24-h6r7

## From the sources

A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_