# CVE-2026-23482: Blinko - Path Traversal

> Live exploitation tracking for CVE-2026-23482 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-23482

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.2
- **Public exploit available:** Yes
- **Affected products:** Blinkospace Blinko
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** web_application, ai_mcp

## Description

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks are enabled, attackers can read backup files to obtain all user notes and user TOKENS. This issue has been patched in version 1.8.4.

## CrowdSec analysis

[CVE-2026-23482](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-23482) is a high-severity path traversal vulnerability in Blinko, an AI-powered card note-taking application, affecting versions prior to 1.8.4. This flaw allows unauthorized attackers to read arbitrary files on the server, including sensitive backup files containing user notes and authentication tokens, by exploiting insufficient permission checks and lack of path traversal filtering. Attackers could leverage this vulnerability to compromise user privacy and potentially gain unauthorized access to user accounts. The issue has been addressed in version 1.8.4.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-23482 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/api/file/temp/` endpoint by appending encoded path traversal sequences (such as `%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd`) to access sensitive files on vulnerable Blinko installations. This allows unauthorized file reads, including system and backup files, without authentication.

## Timeline

- 2026-03-23: CVE Published. CVE-2026-23482 is published to NVD.
- 2026-05-06: Rule Released. CrowdSec releases a rule to detect CVE-2026-23482 exploitation attempts against the CrowdSec Network.
- 2026-06-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-23482 for the first time.

## References

- https://github.com/blinkospace/blinko/releases/tag/1.8.4
- https://github.com/blinkospace/blinko/commit/c48851090767feba431418630c495d90a7da1781
- https://github.com/blinkospace/blinko/security/advisories/GHSA-hrwx-rhrx-f9mm
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23482.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-23482) follows observed exploitation activity for CVE-2026-23482. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.