CVE-2026-124572 · Package
NO FIX YET
Dinky, a Java data platform, has a path traversal flaw in its catalogue upload API (CatalogueController.upload) in versions up to 1.2.5. A remote attacker can use crafted file paths to write files outside the intended directory.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running the Dinky admin service (dinky-admin) up to version 1.2.5 that expose the catalogue upload API. The sources do not say whether authentication is required or whether the flaw is reachable in default configuration. Deployments not running Dinky, or running a newer version, can skip it.
Not affected if newer-version, not-dinky
Who cares dinky, java, self-hosted
1.2.5 are reported as affected.No fix yet, per the sources.
A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.