Technical impact
The flaw arises in Blinko's /api/file/temp endpoint, which lacks permission checks and path‑traversal sanitization. This permits attackers to read any file under the temp/ directory, including backup files that contain all user notes and authentication tokens. The resulting data disclosure exposes sensitive user information and credentials, representing a significant confidentiality breach. The weakness is classified as a path‑traversal issue (CWE‑22).
Affected Systems
The vulnerability is present in the blinkospace blinko product versions prior to 1.8.4. All releases before 1.8.4 expose the unsecured endpoint and are susceptible. The patch was delivered in version 1.8.4.
Risk and Exploitability
With a CVSS score of 8.2, the severity is high, yet the EPSS score indicates a 2% chance of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by issuing a crafted HTTP request to /api/file/temp; authentication is not required for the traversal to succeed. Therefore the risk is largely theoretical until affected deployments are updated.
