A flaw was discovered in the proxyUba endpoint of DataLinkDC dinky’s Flink Proxy Controller module. The function accepts arbitrary URLs and forwards the HTTP request without sufficient validation. An attacker who can send a crafted request to this endpoint can cause the server to issue requests to internal or external resources, potentially exposing sensitive data or enabling further attacks. The vulnerability is an SSRF type weakness, categorized as CWE-918.

The affected product is DataLinkDC dinky, specifically versions up to and including 1.2.5. The vulnerability is located in the dinky‑admin component, in the file FlinkProxyController.java. Users running any of these or earlier releases of dinky are at risk.

The issue carries a CVSS score of 5.3, indicating moderate severity, while the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild at present. The flaw is not part of the CISA Known Exploited Vulnerabilities catalog. An attacker can trigger it remotely by contacting the vulnerable endpoint, and the attack does not require local privileges. Successful exploitation would allow the attacker to reach arbitrary internal hosts or services that the server can access.