CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token
Attackers can write arbitrary files using a hardcoded default token, leading to remote code execution or admin session hijacking in Dinky deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-70558?
CVE-2026-70558 is a critical vulnerability in DataLinkDC Dinky, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path validation. The route is marked @SaIgnore and /download/** is excluded from the Sa-Token interceptor, so the only guard is a header equality check against a dinkyToken value whose default (efda1551-7958-4e0f-80a8-dfd107df3e38) is hardcoded in source and shipped to every deployment. Anyone who can reach Dinky's HTTP port (8888 by default) and supplies the hardcoded token can write arbitrary files as the Dinky service account. The default Docker image runs on 8888 with no proxy or authentication and chmod 777 on /opt/dinky, so the application's own classpath, launch scripts, and static assets are writable. Demonstrated impact: overwriting /opt/dinky/config/static/index.html served attacker JavaScript to admin browsers immediately, and writing /opt/dinky/org/dinky/Dinky.class executed attacker code as the Dinky service account at the next JVM start via a classpath-shadow launched by script/bin/auto.sh. Writes are uid 9999 (flink), not root, so /etc, /root, /home, and /usr are refused. Affects Dinky v1.2.5 (the current release) and the development branch, where the code is byte-identical.
Weakness: CWE-434
Which versions are affected by CVE-2026-70558?
How do I fix CVE-2026-70558?
No fix has been published for CVE-2026-70558 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-70558 being exploited?
There is no known exploitation of CVE-2026-70558 in the wild and no public exploit code.
Sources
Also known as GHSA-2p66-w3p3-5226, GHSA-7crv-rq8j-wxc3.