CVE-2026-124326 DataLinkDC Dinky Catalogue Upload CatalogueController.java file.getOriginalFilename path traversal
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124326?
CVE-2026-124326 is a medium-severity vulnerability in DataLinkDC Dinky, published on 8 Nov 2026.
Official description
A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
Weakness: CWE-22
Which versions are affected by CVE-2026-124326?
How do I fix CVE-2026-124326?
No fix has been published for CVE-2026-124326 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124326 being exploited?
There is no known exploitation of CVE-2026-124326 in the wild and no public exploit code.
Sources
Also known as GHSA-25h5-x769-924v, GHSA-2jp7-3h24-h6r7.