A path‑traversal flaw exists in the saveDevPlugin endpoint of Blinko versions 1.8.3 and earlier. An authenticated user can supply an arbitrary fileName value, which the application writes to the file system without any filtering. This allows the user to overwrite or create files at arbitrary locations, potentially including executables or configuration files. The vulnerability is identified as a CWE‑22 type, and its exploitation could compromise integrity, confidentiality, and availability of the host system.

Blinkospace Blinko, any installations running version 1.8.3 or older. No specific sub‑modules are singled out beyond the standard saveDevPlugin feature. The flaw requires only normal user authentication and does not need super‑admin rights.

The CVSS score of 5.3 indicates a moderate risk; the EPSS score of less than 1% suggests low public exploitation likelihood, and the issue is not listed on CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is an authenticated normal user sending a crafted request to the saveDevPlugin endpoint with a specially formatted fileName that traverses directories (e.g., ../../../../etc/passwd). Because the flaw permits arbitrary file creation, an attacker could overwrite critical system files or place malicious payloads, enabling a wide range of downstream attacks.