{"id":"CVE-2026-108980","revision":"e46bfd6c1f084f0197e1a5ab1c38130a","records":[{"revision":"e46bfd6c1f084f0197e1a5ab1c38130a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-108980","aliases":[],"title":"Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is…","description":"Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.","state":0,"publishedAt":"2026-10-12T01:55:59.223+00:00","modifiedAt":"2026-10-13T19:12:39.874+00:00","affected":[{"ecosystem":"Vendor product","name":"Blinko","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unknown\",\n                    \"product\": \"Blinko\",\n                    \"programFiles\": [\n                        \"server/routerTrpc/plugin.ts\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"installPlugin\"\n                        },\n                        {\n                            \"name\": \"getPluginDir\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/blinko-space/blinko\",\n                    \"vendor\": \"Blinko\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"1.8.8\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/kashishtopi/blinko-plugin-path-traversal-rce","https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerTrpc/plugin.ts#L273","https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/app/src/pages/signin.tsx#L238-L243"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108980","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-108980","identifiers":["CVE-2026-108980"]},"retained":false,"historicalAffected":[]}],"coverage":[]}