CVE-2026-23484
Path Traversal in Blinko Allows Unauthorized File Write Access
Publication date: 2026-03-23
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| blinko | blinko | to 1.8.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-23484 is a path traversal vulnerability in the Blinko project, specifically affecting versions 1.8.3 and earlier. The issue exists in the fileName parameter of the saveDevPlugin mutation, which is not properly filtered or sanitized.'}, {'type': 'paragraph', 'content': "Because of this, an authenticated user with normal privileges can manipulate the fileName parameter to include path traversal sequences (like ../), allowing them to write files anywhere on the server's file system, bypassing intended directory restrictions."}, {'type': 'paragraph', 'content': 'This vulnerability arises from the code that constructs the file path by joining a development plugin directory with the user-supplied fileName without validation, then writing the provided code content to that path.'}, {'type': 'paragraph', 'content': 'No patches were available at the time of the advisory.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability allows an authenticated user with normal privileges to write arbitrary files anywhere on the server's file system."}, {'type': 'paragraph', 'content': 'Such arbitrary file writes can lead to serious consequences including potential code execution, system compromise, or unauthorized modification of critical files.'}, {'type': 'paragraph', 'content': 'Because the vulnerability does not require elevated privileges, it increases the risk that a lower-privileged user could escalate their impact on the system.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring or testing the behavior of the `saveDevPlugin` endpoint (`POST /api/trpc/plugin.saveDevPlugin`) in Blinko versions 1.8.3 and prior. Specifically, attempts to exploit the vulnerability involve sending requests with the `fileName` parameter containing path traversal sequences such as `../` to write files outside the intended directory.'}, {'type': 'paragraph', 'content': 'To detect potential exploitation, you can look for unusual file write activities or HTTP requests to the vulnerable endpoint with suspicious `fileName` values.'}, {'type': 'paragraph', 'content': 'Example commands to test or detect this vulnerability might include using curl to send crafted requests:'}, {'type': 'list_item', 'content': 'curl -X POST https://your-blinko-instance/api/trpc/plugin.saveDevPlugin -H \'Content-Type: application/json\' -d \'{"fileName": "../test.txt", "code": "test content"}\''}, {'type': 'list_item', 'content': 'Check server logs for file writes outside the expected plugin directory or for requests containing path traversal patterns in the `fileName` parameter.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Since there are no publicly available patches at the time of the advisory, immediate mitigation steps include:
- Restrict access to the vulnerable endpoint (`POST /api/trpc/plugin.saveDevPlugin`) to trusted users only, or disable it if not needed.
- Implement additional input validation or filtering on the `fileName` parameter to prevent path traversal sequences such as `../`.
- Monitor logs for suspicious activity targeting this endpoint and unusual file writes outside the intended directories.
- Consider running the application with least privilege to limit the impact of arbitrary file writes.