CVE-2026-124572
Deferred
Deferred - Pending Action
Path Traversal in DataLinkDC Dinky
Vulnerability report for CVE-2026-124572, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-09
Last updated on: 2026-11-09
Assigner: VulDB
Description
Description
A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| DataLinkDC | dinky | 1.2.0 |
| DataLinkDC | dinky | 1.2.1 |
| DataLinkDC | dinky | 1.2.2 |
| DataLinkDC | dinky | 1.2.3 |
| DataLinkDC | dinky | 1.2.4 |
| DataLinkDC | dinky | 1.2.5 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
