CVE-2026-23485: Blinko: Unauthorized Path Traversal File Enumeration - music-metadata
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23485?
CVE-2026-23485 has been classified with a medium severity due to the potential for unauthorized exposure of files through path traversal.
How do I fix CVE-2026-23485?
To fix CVE-2026-23485, upgrade to Blinko version 1.8.4 or later, which addresses the unauthorized path traversal vulnerability.
What does CVE-2026-23485 affect?
CVE-2026-23485 affects versions of Blinko prior to 1.8.4, allowing unauthorized file enumeration on the server.
What are the consequences of CVE-2026-23485?
Exploitation of CVE-2026-23485 can allow an attacker to enumerate files on the server, potentially leading to further attacks.
Is CVE-2026-23485 a common vulnerability?
CVE-2026-23485 is significant as unauthorized path traversal vulnerabilities are common in web applications, posing security risks.