{"id":"CVE-2026-108980","published":"2026-10-12T02:16:57.297","lastModified":"2026-10-16T19:56:15.773","description":"Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-24"],"vendors":[],"products":[],"references":[{"url":"https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/app/src/pages/signin.tsx#L238-L243","tags":[]},{"url":"https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerTrpc/plugin.ts#L273","tags":[]},{"url":"https://github.com/kashishtopi/blinko-plugin-path-traversal-rce","tags":[]}],"exploitRefs":[{"url":"https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/app/src/pages/signin.tsx#L238-L243","tags":[]},{"url":"https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerTrpc/plugin.ts#L273","tags":[]},{"url":"https://github.com/kashishtopi/blinko-plugin-path-traversal-rce","tags":[]}],"hasPoc":true,"ai":{"summary":"Blinko allows authenticated users to perform directory traversal attacks that can overwrite root-owned startup files, enabling remote code execution as root. The vulnerability exists in the plugin installation process where unsanitized user input is used to construct file paths without proper validation.","exploitability":"Exploitation requires an authenticated user account and is relatively straightforward, involving crafting a plugin name with ../ sequences to write files outside the plugins directory, with the Docker image running as root amplifying the impact.","blast_radius":"The vulnerability can lead to full system compromise with remote code execution as root, potentially affecting all containers and host resources when exploited through the official Docker image.","remediation":"Upgrade to version 1.8.9 or later to fix the directory traversal vulnerability in plugin installation.","detection":"Monitor for unusual file creation or modification patterns in the Blinko application directory, particularly around startup script locations, and watch for unexpected network traffic to the plugin installation endpoint.","tags":["rce","directory-traversal","web","docker"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:52:19.515Z"}}