Blinko: Directory traversal in plugin installation allows remote code execution
Summary
Blinko through version 1.8.8 contains a directory traversal flaw in the plugin installer (plugin.installPlugin). The plugin name is used unsanitized to build the install path, so a name containing ../ sequences writes downloaded files outside the plugins directory. The official Docker image runs as root, so an authenticated user can overwrite a root-owned startup file and execute code as root. Self-registration may allow an attacker to obtain the required account.
Affected
- Blinko up to and including 1.8.8
- Official Docker image (runs as root)
Fixed in
Unknown.
Workaround
- Disable self-registration and restrict plugin installation to administrators
- Do not expose the instance directly to the internet; use a VPN or an SSO-enforcing reverse proxy
- Run the container as a non-root user with a read-only root filesystem where possible, and limit write access to the plugin directory
- Review existing plugin installations and check startup files for unexpected changes
Exploitation
- Public proof of concept: yes (third-party repository)
- CISA SSVC: exploitation poc, automatable no, technical impact total
- Known exploited in the wild: no evidence found
- Sources conflict on exploit availability (VulDB reports none)
Our recommendation
- Update Blinko as soon as a fixed version is published by the vendor; upgrading to 1.8.4 does not address this CVE
- Apply the workarounds above immediately
- Check the instance for unexpected plugins and modified startup files
- Monitor the vendor's release channel and this tracker for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-108980 on OSV osv.dev
- VulDB 416798 vuldb.com
- Vulners CVE record (CVELIST) vulners.com
- Blinko plugin.ts at pinned commit github.com
- Third-party PoC repository github.com
- Strix CVE record www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:33.
Original description (NVD)
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.