CVE-2026-3051

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

A vulnerability has been found in DataLinkDC dinky up to 1.2.5. The affected element is the function getProjectDir of the file dinky-admin/src/main/java/org/dinky/utils/GitRepository.java of the component Project Name Handler. Such manipulation of the argument projectName leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Feb 24, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-305127.8A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI priCVE-2026-30527.7A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/jaCVE-2026-305205.4A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file CVE-2026-305216.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application CVE-2026-305226.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application CVE-2026-305236.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the lack of proper input validation. The applicatCVE-2026-305266.1A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in thCVE-2026-305275.4A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management modulCVE-2026-305298.8A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_user CVE-2026-30539.8A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/jCVE-2026-305309.8A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_custoCVE-2026-305318.8A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_categ
CVE-2026-3051: High severity, CVSS 7.6 | Vulnix