The flaw resides in the Blinko component saveAdditionalDevFile, permitting an authenticated user to write files to arbitrary paths. This can lead to the overwriting or creation of files that the application depends on, potentially disrupting functionality or providing a foothold for further malicious actions. The weakness is a classic absolute path traversal (CWE‑22).

Blinko, provided by blinkospace, affected in all releases prior to version 1.8.4. Any deployment using an earlier version is vulnerable.

The vulnerability scores a CVSS of 5.3, indicating moderate severity. The EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated within the Blinko environment; no public exploit has been disclosed. Attackers with legitimate access could craft file names that redirect writes to critical locations, thereby degrading data integrity or enabling persistence.