CVE-2026-108980
Received Received - Intake

Directory Traversal in Blinko Leading to Root RCE

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: MITRE

Description
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108980
EUVD
EUVD-2026-97145

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Blinko Blinko 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-24 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108980 is a directory traversal vulnerability in Blinko through version 1.8.8. It allows authenticated users to overwrite startup files as root by exploiting an unsanitized plugin name parameter in the plugin installer. The vulnerability occurs because the plugin install path is built without proper validation, enabling ../ sequences to escape the plugins directory. Since the official Docker image runs as root, this leads to remote code execution with root privileges.

Detection Guidance

Check Blinko plugin installation logs for unusual file paths containing ../ sequences. Inspect the plugin.installPlugin tRPC procedure in server/routerTrpc/plugin.ts for unsanitized name parameters. Review files modified outside the plugins directory, especially root-owned startup files.

Impact Analysis

An attacker with authenticated access can overwrite critical system files, leading to complete system compromise. This includes executing arbitrary code with root privileges, potentially taking full control of the server. The impact includes data theft, system disruption, and unauthorized access to sensitive information.

Compliance Impact

This vulnerability severely impacts compliance with GDPR and HIPAA due to the potential for unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A successful exploit could result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Blinko to a patched version beyond 1.8.8. Disable self-registration for accounts if enabled. Restrict tRPC procedure access to authenticated users only. Sanitize plugin names to prevent path traversal. Run Blinko as a non-root user in Docker to limit impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108980. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart