DataLinkDC Dinky: Path traversal in Catalogue Upload (CVE-2026-124326)

A remote path traversal vulnerability exists in DataLinkDC Dinky (up to version 1.2.5) within the CatalogueController.java component. The file.getOriginalFilename function fails to properly validate the filename argument during catalogue upload, allowing an attacker to perform unauthorized file operations on the host system. A proof-of-concept exploit has been published publicly.

Impact

Successful exploitation allows a remote attacker with low-level privileges to manipulate file paths, potentially resulting in unauthorized file creation or overwriting on the host server.

Recommendation

• Identify all instances of DataLinkDC Dinky in your environment.
• Review the official GitHub repository for patches or updates to address the vulnerability documented in GHSA-2jp7-3h24-h6r7.
• Implement strict ingress filtering and input validation for all upload endpoints, specifically monitoring requests to CatalogueController.java for path traversal sequences like ../ or encoded equivalents.