Blinko - Path Traversal (CVE-2026-23482)

CVE-2026-23482 is a high-severity path traversal vulnerability in Blinko, an AI-powered card note-taking application, affecting versions prior to 1.8.4. This flaw allows unauthorized attackers to read arbitrary files on the server, including sensitive backup files containing user notes and authentication tokens, by exploiting insufficient permission checks and lack of path traversal filtering. Attackers could leverage this vulnerability to compromise user privacy and potentially gain unauthorized access to user accounts. The issue has been addressed in version 1.8.4.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-23482 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the /api/file/temp/ endpoint by appending encoded path traversal sequences (such as %2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd) to access sensitive files on vulnerable Blinko installations. This allows unauthorized file reads, including system and backup files, without authentication.