CVE-2026-23485

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23485", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T15:47:41.628Z", "datePublished": "2026-03-23T20:50:02.880Z", "dateUpdated": "2026-03-24T15:13:17.335Z"}, "containers": {"cna": {"title": "Blinko: Unauthorized Path Traversal File Enumeration - music-metadata", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7q"}, {"name": "https://github.com/blinkospace/blinko/commit/9d6fa80a3e11a99886f90e048657443335fd3e7d", "tags": ["x_refsource_MISC"], "url": "https://github.com/blinkospace/blinko/commit/9d6fa80a3e11a99886f90e048657443335fd3e7d"}, {"name": "https://github.com/blinkospace/blinko/releases/tag/1.8.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/blinkospace/blinko/releases/tag/1.8.4"}], "affected": [{"vendor": "blinkospace", "product": "blinko", "versions": [{"version": "< 1.8.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T20:50:02.880Z"}, "descriptions": [{"lang": "en", "value": "Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4."}], "source": {"advisory": "GHSA-5x64-pmfq-pw7q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:41:45.162698Z", "id": "CVE-2026-23485", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T15:13:17.335Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23485", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T14:41:45.162698Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:41:51.453Z"}}], "cna": {"title": "Blinko: Unauthorized Path Traversal File Enumeration - music-metadata", "source": {"advisory": "GHSA-5x64-pmfq-pw7q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "blinkospace", "product": "blinko", "versions": [{"status": "affected", "version": "< 1.8.4"}]}], "references": [{"url": "https://github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7q", "name": "https://github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/blinkospace/blinko/commit/9d6fa80a3e11a99886f90e048657443335fd3e7d", "name": "https://github.com/blinkospace/blinko/commit/9d6fa80a3e11a99886f90e048657443335fd3e7d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/blinkospace/blinko/releases/tag/1.8.4", "name": "https://github.com/blinkospace/blinko/releases/tag/1.8.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T20:50:02.880Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23485", "state": "PUBLISHED", "dateUpdated": "2026-03-24T15:13:17.335Z", "dateReserved": "2026-01-13T15:47:41.628Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-23T20:50:02.880Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "blinko", "vendor": "blinkospace", "versions": [{"status": "affected", "version": "< 1.8.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:*", "matchCriteriaId": "31941A3D-C688-40DF-AA55-1AF9056275D0", "versionEndExcluding": "1.8.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4."}, {"lang": "es", "value": "Blinko es un proyecto de toma de notas en tarjetas impulsado por IA. Antes de la versi\u00f3n 1.8.4, el par\u00e1metro filePath acepta secuencias de salto de ruta, permitiendo la enumeraci\u00f3n de la existencia de archivos en el servidor a trav\u00e9s de diferentes respuestas de error. Este problema ha sido parcheado en la versi\u00f3n 1.8.4."}], "id": "CVE-2026-23485", "lastModified": "2026-06-17T10:21:40.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23485", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T14:41:45.162698Z", "version": "2.0.3"}}]}, "published": "2026-03-23T21:17:02.840", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/blinkospace/blinko/commit/9d6fa80a3e11a99886f90e048657443335fd3e7d"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/blinkospace/blinko/releases/tag/1.8.4"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "blinko", "source": "cna", "vendor": "blinkospace"}, "product": "blinko", "vendor": "blinkospace"}], "analysis": {"en": {"generated_at": "2026-03-24T20:32:29.904658+00:00", "value": {"mitigation_remediation": ["Apply the official patch to Blinko version 1.8.4 or later."], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure via Path Traversal"}, "threat_synthesis": {"affected_systems": "The affected product is Blinko, released by blinkospace. All versions prior to 1.8.4 are vulnerable because the filePath handling was not secured. Users running any pre\u20111.8.4 release may unintentionally disclose file existence on their server.", "description_and_impact": "Blinko accepts a filePath parameter that does not properly sanitize path traversal sequences. When an attacker sends a crafted file path, the server replies with different error messages depending on whether the specified file exists. This difference allows the adversary to enumerate files on the host. The weakness is a path traversal flaw identified as CWE\u201122, exposing confidential or configuration data and enabling subsequent attacks.", "risk_and_exploitability": "With a CVSS score of 6.9 the vulnerability presents moderate severity, and its EPSS score of less than 1% indicates a low probability of active exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw by issuing HTTP requests to the filePath endpoint with carefully crafted paths and analyzing the error responses to determine which files are present, thereby enabling information disclosure that could facilitate more targeted attacks."}}}}, "created": "2026-03-24T10:32:47.686230+00:00", "updated": "2026-03-25T20:36:36.387911+00:00", "vendors": ["blinkospace", "blinkospace$PRODUCT$blinko"]}