CVE-2026-23481

Blinko: Authenticated Arbitrary File Write - saveAdditionalDevFile

State: Published
Severity: 5.3 Medium
Published: Mar 23, 2026
Updated: Mar 24, 2026
Reserved: Jan 13, 2026

Description

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an authenticated arbitrary file write vulnerability in saveAdditionalDevFile. This issue has been patched in version 1.8.4.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
blinkoblinkospace	< 1.8.4Affected

References

https://github.com/blinkospace/blinko/security/advisories/GHSA-38hg-8p2j-76g5
https://github.com/blinkospace/blinko/commit/02a4205f1ad22d0e78dc2ab2967b551d0dbd0a06
https://github.com/blinkospace/blinko/releases/tag/1.8.4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.