CVE-2026-124326

Name of the Vulnerable Software and Affected Versions DataLinkDC Dinky versions prior to 1.2.6

Description In the Catalogue Upload component, the file.getOriginalFilename function within the CatalogueController.java file is susceptible to path traversal. This occurs when the filename argument is manipulated, allowing a remote attacker to access files or directories outside the intended folder.

Recommendations Update DataLinkDC Dinky to version 1.2.6 or later. As a temporary mitigation, restrict the use of the filename argument in the Catalogue Upload component.