{"id":"CVE-2026-124572","kind":"vulnerability","aliases":["CVE-2026-124572"],"related":[],"title":"Dinky: catalogue upload path traversal lets remote users write files","description":"A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.","summary":"Dinky, a Java data platform, has a path traversal flaw in its catalogue upload API (CatalogueController.upload) in versions up to 1.2.5. A remote attacker can use crafted file paths to write files outside the intended directory.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dinky","java","package","self-hosted"],"not_affected_if":["newer-version","not-dinky"],"how_to_check":"- Check the installed Dinky version in the deployment or build files; versions up to `1.2.5` are reported as affected.\n- Confirm whether the Dinky admin service is reachable from the network, since the sources say the attack can be carried out remotely.","fix":null,"status":"open","published_at":"2026-11-09T07:17:30+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","triaged_at":"2026-11-09T07:25:28+00:00","updated_at":"2026-11-09T07:25:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T07:25:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dinky: catalogue upload path traversal lets remote users write files","impact":"medium","summary":"Dinky, a Java data platform, has a path traversal flaw in its catalogue upload API (CatalogueController.upload) in versions up to 1.2.5. A remote attacker can use crafted file paths to write files outside the intended directory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dinky","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker writes files to arbitrary server paths","analyst_note":"Find the fixed version and whether upload requires login: check the GHSA referenced in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-124572) and the vendor advisory linked in the sources.","how_to_check":"- Check the installed Dinky version in the deployment or build files; versions up to `1.2.5` are reported as affected.\n- Confirm whether the Dinky admin service is reachable from the network, since the sources say the attack can be carried out remotely.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-dinky","newer-version"],"who_is_affected":"Teams running the Dinky admin service (dinky-admin) up to version 1.2.5 that expose the catalogue upload API. The sources do not say whether authentication is required or whether the flaw is reachable in default configuration. Deployments not running Dinky, or running a newer version, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4605,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124572':13A,16A '-2026':12A,15A '/src/main/java/org/dinky/controller/cataloguecontroller.java':84C '1.2.5':43B,69C 'admin':83C 'affect':70C 'api':37B,90C 'attack':46B,98C 'carri':103C 'catalogu':2A,35B,88C 'cataloguecontroller.upload':38B,77C 'claim':108C 'compon':87C 'craft':49B 'cve':11A,14A 'data':26B 'datalinkdc':65C 'dinki':1A,17B,23B,66C,82C 'dinky-admin':81C 'directori':58B 'file':10A,50B,54B,80C 'flaw':32B 'found':63C 'function':76C 'ghsa':113C 'host':22B 'intend':57B 'issu':73C 'java':18B,25B 'lead':93C 'let':6A 'manipul':92C 'outsid':55B 'packag':19B 'path':4A,30B,51B,95C 'platform':27B 'possibl':100C 'project':119C 'remot':7A,45B,105C 'repositori':116C 'research':107C 'self':21B 'self-host':20B 'submit':111C 'travers':5A,31B,96C 'upload':3A,36B,89C 'use':48B 'user':8A 'version':40B 'vulner':60C 'write':9A,53B","nicknames":[],"mitigations":[],"who_affected":"Teams running the Dinky admin service (dinky-admin) up to version 1.2.5 that expose the catalogue upload API. The sources do not say whether authentication is required or whether the flaw is reachable in default configuration. Deployments not running Dinky, or running a newer version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dinky","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124572':13A,16A '-2026':12A,15A 'catalogu':2A 'cve':11A,14A 'dinki':1A 'file':10A 'let':6A 'path':4A 'remot':7A 'travers':5A 'upload':3A 'user':8A 'write':9A","search_b":"'1.2.5':43B 'api':37B 'attack':46B 'catalogu':35B 'cataloguecontroller.upload':38B 'craft':49B 'data':26B 'dinki':17B,23B 'directori':58B 'file':50B,54B 'flaw':32B 'host':22B 'intend':57B 'java':18B,25B 'outsid':55B 'packag':19B 'path':30B,51B 'platform':27B 'remot':45B 'self':21B 'self-host':20B 'travers':31B 'upload':36B 'use':48B 'version':40B 'write':53B","search_c":"'/src/main/java/org/dinky/controller/cataloguecontroller.java':84C '1.2.5':69C 'admin':83C 'affect':70C 'api':90C 'attack':98C 'carri':103C 'catalogu':88C 'cataloguecontroller.upload':77C 'claim':108C 'compon':87C 'datalinkdc':65C 'dinki':66C,82C 'dinky-admin':81C 'file':80C 'found':63C 'function':76C 'ghsa':113C 'issu':73C 'lead':93C 'manipul':92C 'path':95C 'possibl':100C 'project':119C 'remot':105C 'repositori':116C 'research':107C 'submit':111C 'travers':96C 'upload':89C 'vulner':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124572","severity":null,"published_at":"2026-11-09T07:17:30+00:00","modified_at":"2026-11-09T07:17:31+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","fetched_at":"2026-11-09T07:25:05+00:00","note":null}],"documents":[{"id":106283,"url":"https://github.com/DataLinkDC/dinky/security/advisories/GHSA-vqj5-2vxg-f4mq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}