CVE-2026-108980

{
  "etk_id": "ETK-2026-1281",
  "cve_id": "CVE-2026-108980",
  "display_id": "CVE-2026-108980",
  "ghsa_id": "GHSA-q62g-66hr-78pq",
  "euvd_id": "EUVD-2026-97145",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated path traversal in Blinko plugin installation",
  "summary": "Blinko through 1.8.8 does not safely constrain plugin installation paths. An authenticated user may write plugin content outside the intended directory and, in root-running container deployments, could cause code to run with root privileges. Accounts that can access plugin installation are required; self-registration may make that access easier to obtain.",
  "mitigation": "Disable or tightly restrict plugin installation to trusted administrators, and disable self-registration where it is not required. Run the service container as a non-root user and limit writable paths until an updated release is available.",
  "vendor": "Blinko",
  "product": "Blinko",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.8.8"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Blinko",
      "purl": null
    }
  ],
  "cwes": [
    24
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0106,
  "epss_percentile": 0.6414,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.427698783333334,
  "t0_at": "2026-10-12T01:55:59.223000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-11T04:45:52+00:00",
      "days": -0.8820280439814815,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T01:55:59.223000+00:00",
      "url": "https://github.com/kashishtopi/blinko-plugin-path-traversal-rce"
    },
    "trigger_signal": {
      "at": "2026-10-12T01:55:59.223000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T01:55:59.223000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108980"
    }
  }
}