Blinko accepts a filePath parameter that does not properly sanitize path traversal sequences. When an attacker sends a crafted file path, the server replies with different error messages depending on whether the specified file exists. This difference allows the adversary to enumerate files on the host. The weakness is a path traversal flaw identified as CWE‑22, exposing confidential or configuration data and enabling subsequent attacks.

The affected product is Blinko, released by blinkospace. All versions prior to 1.8.4 are vulnerable because the filePath handling was not secured. Users running any pre‑1.8.4 release may unintentionally disclose file existence on their server.

With a CVSS score of 6.9 the vulnerability presents moderate severity, and its EPSS score of less than 1% indicates a low probability of active exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw by issuing HTTP requests to the filePath endpoint with carefully crafted paths and analyzing the error responses to determine which files are present, thereby enabling information disclosure that could facilitate more targeted attacks.