CVE-2026-70558

Name of the Vulnerable Software and Affected Versions Dinky version 1.2.5

Description The POST '/download/uploadFromRsByLocal' endpoint fails to validate the path parameter, which is passed directly to the new File(path) and file.transferTo(dest) functions. This allows an attacker to write arbitrary files using the Dinky service account. The endpoint is excluded from the Sa-Token interceptor and relies on a hardcoded dinkyToken value for authentication, which is shipped with every deployment. In default Docker installations, the application runs on port 8888 with permissive permissions on /opt/dinky, enabling the overwriting of static assets, launch scripts, and the application classpath. This can lead to the execution of arbitrary code via classpath-shadowing upon the next JVM restart.

Recommendations For version 1.2.5, restrict access to the '/download/uploadFromRsByLocal' endpoint or avoid using the path parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.