PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
medium·Product Based Web Vulnerabilities·Updated Apr 30, 2026

Blinko <= 1.8.3 - Path Traversal via /plugins

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsurl
CostFree
2.8k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
6.9
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description

Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
blinkoby blinkospace
<= 1.8.3
Updated Sep 18, 2026View on NVD →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Blinko <= 1.8.3 - Path Traversal via /plugins CVE-2026-23483 Scanner | S4E