Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108980

Quick assessment

Affected
Blinko Blinko
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Blinko 1.8.8 版本中存在目录遍历漏洞，攻击者可利用该漏洞以 root 权限覆盖启动文件。该问题源于 文件中构建插件安装路径时未对插件名称进行充分 sanitization（清理/校验）。 tRPC 过程接口对所有已认证用户开放，因此，若插件名称中包含 序列，即可将下载的插件文件写入 plugins 目录之外。由于官方 Docker 镜像以 root 身份运行，已认证的攻击者可以覆盖由 root 拥有的启动文件，从而实现以 root 权限的远程代码执行（RCE）。此外，系统可能允许用户自行注册账户。

CVSS 8.8 · High EPSS 1.06% · P64

Affected Version Matrix 1

VendorProduct Version RangeStatus
Blinko Blinko ≤ 1.8.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108980

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
路径遍历：’../filedir’
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Blinko Blinko 0 ~ 1.8.8 -

II. Public POCs for CVE-2026-108980

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108980

请登录查看更多情报信息。

Proof of Concept for CVE-2026-108980 (2)

Other References for CVE-2026-108980 (1)

IV. Related Vulnerabilities

Same product: Blinko
Same weakness: CWE-24

V. Comments for CVE-2026-108980

No comments yet

Leave a comment