CVE-2026-23482

Blinko: Unauthorized Arbitrary File Read - /api/file/temp

8.2 High

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks are enabled, attackers can read backup files to obtain all user notes and user TOKENS. This issue has been patched in version 1.8.4.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.52%Up 1.5 points since Mar 24, 2026

What each source reports

CVE List Score used 8.2

Blinko: Unauthorized Arbitrary File Read - /api/file/temp

Record: CVE-2026-23482
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2026-14533 8.2

Record: EUVD-2026-14533
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

NVD 8.2

Record: CVE-2026-23482
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSV 8.2

Blinko: Unauthorized Arbitrary File Read - /api/file/temp

Record: CVE-2026-23482
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-22
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Blinko < 1.8.4 - Path Traversal

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-23482 is a high vulnerability (CVSS 8.2) in Blinko, published March 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. No source names a fixed version.