CVE-2026-124572: DataLinkDC dinky Catalogue Upload API CatalogueController.java CatalogueController.upload path traversal
A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be performed remotely, but the CVSS vector indicates that the attacker needs low-level privileges. No user interaction is required.
Which deployments should be considered affected?
DataLinkDC dinky versions up to 1.2.5 are identified as affected, specifically the Catalogue Upload API's CatalogueController.upload function. The provided information does not state whether the API is enabled or exposed by default.
What impact is indicated by the available severity data?
The CVSS vector indicates low integrity and availability impact, with no confidentiality impact. The issue is classified as path traversal.