CVE-2026-124572

5.4 MEDIUMpublic exploit available

Published 2026-11-09 · Updated 2026-11-09

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weaknesses

CWE-22

Public exploit & PoC references

https://github.com/DataLinkDC/dinky/
https://github.com/DataLinkDC/dinky/security/advisories/GHSA-vqj5-2vxg-f4mq

All references

https://github.com/DataLinkDC/dinky/
https://github.com/DataLinkDC/dinky/security/advisories/GHSA-vqj5-2vxg-f4mq
https://vuldb.com/cve/CVE-2026-124572
https://vuldb.com/submit/1036005
https://vuldb.com/vuln/432918
https://vuldb.com/vuln/432918/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2012-20002PoC
HIGHCVE-2014-125130PoC
HIGHCVE-2014-125133PoC
HIGHCVE-2014-125134PoC
HIGHCVE-2015-20123PoC
HIGHCVE-2015-20124PoC
HIGHCVE-2015-20125PoC
HIGHCVE-2016-20100PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.