Security readout for executives and security teams
Plain-English summary
CVE-2026-3051 affects DataLinkDC Dinky versions 1.2.0 through 1.2.5. A project name value can be manipulated to traverse file paths in GitRepository.java. The issue is remotely reachable but appears to require authentication. Public proof-of-concept material is referenced, but the sources do not show confirmed active exploitation or a vendor fix.
Executive priority
Treat as a near-term exposure review item, not an emergency based on current evidence. Public PoC availability raises risk, but authentication is indicated and active exploitation is not confirmed. Prioritize internet-facing or broadly accessible Dinky deployments first.
Technical view
The reported flaw is CWE-22 path traversal in getProjectDir within dinky-admin/src/main/java/org/dinky/utils/GitRepository.java, tied to Project Name Handler input. VulDB assigns CVSS v2 6.5: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR. A related submission describes arbitrary file writes, but vendor confirmation is absent.
Likely exposure
Organizations running DataLinkDC Dinky 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, or 1.2.5 may be exposed, especially where Dinky administrative or project-management functions are reachable by users or networks beyond trusted operators.
Exploitation context
The sources state remote exploitation is possible and public exploit information exists. CVSS indicates single authentication is required. CISA KEV is not listed in the provided data, and no cited source confirms active exploitation in the wild.
Researcher notes
Evidence is mainly from CVE/VulDB records and a public GitHub issue. The vendor reportedly did not respond, and no patch is named in the supplied sources. Validate impact in a controlled, authorized environment only; avoid assuming exploitability beyond the affected versions and component described.
Mitigation direction
- Identify all DataLinkDC Dinky instances and their exact versions.
- Restrict access to Dinky admin and project features to trusted users and networks.
- Review vendor, CVE, and VulDB pages for any newly published fix or guidance.
- If source changes are maintained, enforce safe path validation after vendor review.
- Monitor for unexpected file changes in Dinky project and repository directories.
Validation and detection
- Confirm whether any Dinky deployment runs versions 1.2.0 through 1.2.5.
- Verify administrative and project-management endpoints require strong authentication and limited authorization.
- Review application logs for suspicious project-name handling or path traversal indicators.
- Check file integrity around Dinky project repositories and admin working directories.
- Document whether compensating network controls cover each affected instance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-3051 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-347409 | DataLinkDC dinky Project Name GitRepository.java getProjectDir path traversalCVE reference · vdb-entry, technical-description
- VDB-347409 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #757586 | DataLinkDC dinky <=1.2.5 arbitrary file writesCVE reference · third-party-advisory
- https://github.com/AnalogyC0de/public_exp/issues/5CVE reference · issue-tracking, exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.