CVE-2026-108980: High severity Blinko Blinko vulnerability
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can invoke the plugin.installPlugin tRPC procedure. If self-registration is enabled or otherwise available, an attacker may be able to create their own account before exploiting it.
Which deployments are at greatest risk?
Deployments using the official Docker image are at greatest risk because it runs as root. An attacker can use traversal sequences in a plugin name to write downloaded files outside the plugins directory and overwrite a root-owned startup file.
Does exploitation require user interaction or complex conditions?
No user interaction is required, and the reported attack complexity is low. The attacker needs authentication and must be able to submit a plugin installation request with a name containing ../ traversal sequences.
What is the impact after successful exploitation in the official container?
The attacker can achieve remote code execution as root by overwriting a startup file. This can compromise confidentiality, integrity, and availability of the affected instance.