The vulnerability resides in the getProjectDir function of DataLinkDC dinky’s Project Name Handler. By manipulating the projectName argument, an attacker can inject path traversal sequences to escape the intended project directory and read arbitrary files on the host, achieving a directory traversal flaw identified as CWE-22. The attack can be performed from a remote source, allowing the attacker to potentially access sensitive configuration or code files outside the normal repository scope.

DataLinkDC dinky versions up to 1.2.5 are affected. The flaw exists in the file dinky-admin/src/main/java/org/dinky/utils/GitRepository.java within the Project Name Handler component.

The CVSS base score of 5.3 reflects moderate severity, while the EPSS score of less than 1% indicates a low expected exploitation probability at present. This vulnerability is not listed in the CISA KEV catalog. Remote exploitation is feasible by sending a specially crafted projectName value from an external network, potentially granting an attacker read access to files outside the intended directory. No further privileges or conditions are explicitly required, making the risk realistic for exposed configurations.