high·Product Based Web Vulnerabilities·Updated Apr 30, 2026

Blinko < 1.8.4 - Path Traversal

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsurl

CostFree

3.3k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2026-23482

8.2

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks are enabled, attackers can read backup files to obtain all user notes and user TOKENS. This issue has been patched in version 1.8.4.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

blinkoby blinkospace

< 1.8.4

Updated Sep 18, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

Blinko < 1.8.4 - Path Traversal

Check your infrastructure.Right now.

Check your infrastructure.
Right now.