#NØØT_Security_Alerts 🚨 #ALERT — BLINKO PLUGIN INSTALLATION FLAW ENABLES POTENTIAL ROOT-LEVEL REMOTE CODE EXECUTION October 12, 2026 DISCLOSED BY: Independent Security Researcher / MITRE CVE Program PRODUCT: Blinko — Self-Hosted Application CVE: CVE-2026-108980 SEVERITY: High — CVSS 8.8 AFFECTED VERSIONS: Blinko 1.8.8 and earlier. IMPACT: Path traversal in the plugin.installPlugin tRPC procedure allows authenticated users to write downloaded plugin files outside the intended directory. The official Docker image runs as root. An attacker may overwrite privileged startup files and achieve code execution with root privileges inside the container when those files execute. EXPOSURE: Network-accessible Blinko installations where an attacker possesses an ordinary user account. Enabled self-registration may allow attackers to obtain the required account. EXPLOITATION STATUS: PUBLIC RESEARCH PoC. Source-level technical analysis and exploit documentation are available. No confirmed malicious in-the-wild exploitation or independently verified victim compromise. Forensic triage: Investigate unexpected plugin.installPlugin requests, traversal sequences, unauthorized plugin installations, modified startup files and suspicious container processes. No confirmed malicious infrastructure IOCs. URGENT ACTION: Restrict application access and disable untrusted plugin installation. Disable public self-registration where unnecessary. Review container privileges, investigate suspicious file modifications and monitor upstream remediation. No verified fixed release identified. SOURCE: https://github.com/kashishtopi/blinko-plugin-path-traversal-rce CVE RECORD: https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/108xxx/CVE-2026-108980.json CONFIDENCE: MODERATE-HIGH — Published CVE, upstream source code and researcher PoC support the reported exploit path. Independent reproduction and vendor confirmation remain unverified. #CyberSecurity #ThreatIntel #Blinko #RCE #PathTraversal #ContainerSecurity