CVE-2026-108980

Summary

Blinko allows authenticated users to perform directory traversal attacks that can overwrite root-owned startup files, enabling remote code execution as root. The vulnerability exists in the plugin installation process where unsanitized user input is used to construct file paths without proper validation.

Exploitability

Exploitation requires an authenticated user account and is relatively straightforward, involving crafting a plugin name with ../ sequences to write files outside the plugins directory, with the Docker image running as root amplifying the impact.

Blast radius

The vulnerability can lead to full system compromise with remote code execution as root, potentially affecting all containers and host resources when exploited through the official Docker image.

Detection

Monitor for unusual file creation or modification patterns in the Blinko application directory, particularly around startup script locations, and watch for unexpected network traffic to the plugin installation endpoint.

Prioritized remediation

Upgrade to version 1.8.9 or later to fix the directory traversal vulnerability in plugin installation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.