CVE-2026-23483 Scanner
CVE-2026-23483 Scanner - Path Traversal vulnerability in blinko
Used 3.1k times · 5.9k assets checked · url
CVE
CVE-2026-23483
6.9
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description
Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
blinko
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: blinko
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →