CVE-2026-23485 MEDIUM

CVE-2026-23485: Blinko: Unauthorized Path Traversal File Enumeration - music-metadata

Vendor Blinkospace

Product blinko

Weakness CWE-22 · Path traversal

Published March 23, 2026

Last update March 24, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4.

Key dates

02Disclosure timeline

March 23, 2026 CVE published

March 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-23485 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2024-2210 The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing CVE-2022-44748 Uploading workflows to KNIME Server may override arbitrary file system contents CVE-2025-54029 WordPress WooCommerce csv import export Plugin <= 2.0.6 - Arbitrary File Deletion Vulnerability CVE-2024-38709 WordPress GD Rating System plugin <= 3.6 - Local File Inclusion vulnerability CVE-2024-8707 云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal