Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CVE-2026-23483 - medium 🚨 Blinko <= 1.8.3 - Path Traversal via /plugins > Blinko <= 1.8.3 contains a path traversal caused by improper path concatenation witho... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-23483 @pdnuclei #NucleiTemplates #cve
Post summary
A medium‑severity CVE‑2026‑23483 that allows path traversal in Blinko versions ≤1.8.3, with technical details provided and a link to further information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | blinko | blinko | - | - | - |