Security readout for executives and security teams
Plain-English summary
A remote attacker who can reach Dinky’s web service and knows its shipped default token can overwrite files owned by the service account. This can alter administrator-facing content immediately or execute attacker-controlled code after Dinky restarts. It is not root access, but it can compromise the application, its data, and operations.
Executive priority
Treat this as an immediate containment and investigation priority for reachable Dinky deployments. Restrict access now, determine token and version exposure, check application-file integrity, and follow the vendor advisory for remediation.
Technical view
In Dinky v1.2.5 and the byte-identical development branch, POST /download/uploadFromRsByLocal accepts a caller-controlled path and writes uploaded content without validation. Authentication is bypassed through @SaIgnore and the /download/** interceptor exclusion; only the default hardcoded dinkyToken remains. Writable application files enable stored browser script injection and classpath shadowing after JVM restart under uid 9999.
Likely exposure
Exposure is highest where Dinky’s HTTP port, 8888 by default, is reachable from untrusted networks and the shipped token remains unchanged. The default Docker image reportedly lacks proxy authentication and makes /opt/dinky broadly writable. Network isolation and replacing the default token reduce reachability, but the affected file-write behavior remains.
Exploitation context
The supplied sources document successful demonstrations against static content and application class files. They do not establish exploitation in the wild, and the CVE is not marked KEV. Impact is constrained to files writable by the Dinky service account; protected root-owned locations were reportedly inaccessible.
Researcher notes
Evidence supports an unauthenticated-in-practice arbitrary file write because a universal default token is the route’s only guard. The affected-version metadata is inconsistent: structured data lists version “0,” while the description identifies v1.2.5 and the development branch. No fixed version or confirmed widespread exploitation is provided.
Mitigation direction
- Restrict Dinky port 8888 to trusted management networks and block untrusted ingress immediately.
- Replace the shipped default dinkyToken wherever configuration permits, and protect the replacement as a secret.
- Check the vendor advisory for a fixed release; the provided sources do not identify one.
- Rebuild from a trusted image if integrity checks find unauthorized writes or classpath changes.
Validation and detection
- Inventory Dinky deployments and identify any running v1.2.5 or matching development builds.
- Verify whether port 8888 or another Dinky HTTP endpoint is reachable from untrusted networks.
- Confirm deployments are not using the shipped default dinkyToken.
- Review /opt/dinky integrity, especially static content, launch scripts, configuration, and classpath files.
- Review service-account file changes, JVM restarts, and suspicious content delivered to administrator browsers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-70558 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/DataLinkDC/dinkyCVE reference, VulnCheck · product
- https://github.com/DataLinkDC/dinky/issues/4566CVE reference, VulnCheck · technical-description
- https://github.com/DataLinkDC/dinky/security/advisories/GHSA-2p66-w3p3-5226CVE reference, VulnCheck · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.