Medium severity5.3NVD Advisory· Published Mar 23, 2026· Updated Jun 17, 2026

CVE-2026-23485

Description

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file existence on the server via different error responses. This issue has been patched in version 1.8.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Blinko/Blinko
cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:*
Range: <1.8.4
Blinkospace/blinkollm-fuzzy
Range: <1.8.4
blinkospace/blinkov5
Range: < 1.8.4

Patches

Vulnerability mechanics

References

github.com/blinkospace/blinko/commit/9d6fa80a3e11a99886f90e048657443335fd3e7dnvdPatch
github.com/blinkospace/blinko/security/advisories/GHSA-5x64-pmfq-pw7qnvdVendor Advisory
github.com/blinkospace/blinko/releases/tag/1.8.4nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000