GHSA-vqj5-2vxg-f4mq: DataLinkDC dinky Catalogue Upload API CatalogueController.java CatalogueController.upload path traversal
Published Nov 9, 2026
·Updated
A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.
Affected Software
1 affected component
DataLinkDC dinky<=1.2.5
Event History
Nov 9, 2026
CVE Published
via OSV·06:00 AM
Data Sourced
via OSV·06:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions should be treated as affected?
DataLinkDC dinky versions up to and including 1.2.5 are identified as affected.
2
Does an attacker need access before exploiting this issue?
The provided CVSS vector indicates low privileges are required. The attack can be performed remotely and does not require user interaction.