CVE-2026-124326 | DataLinkDC Dinky up to 1.2.5 Catalogue Upload CatalogueController.java file.getOriginalFilename filename path traversal (GHSA-2jp7-3h24-h6r7)

SecurityVulns
Yanac

A vulnerability was found in DataLinkDC Dinky up to 1.2.5 and classified as problematic. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal.

This vulnerability is handled as CVE-2026-124326. The attack can be executed remotely. Additionally, an exploit exists.

The researcher claims to have submitted a GHSA on the repository of the project.VulDB Recent EntriesRead More