CVE-2026-3051 is a path traversal vulnerability identified in the DataLinkDC dinky software, specifically affecting versions 1.2.0 through 1.2.5. The vulnerability resides in the getProjectDir function of the dinky-admin/src/main/java/org/dinky/utils/GitRepository.java file, part of the Project Name Handler component. The issue arises because the function improperly validates or sanitizes the projectName parameter, allowing an attacker to craft malicious input that traverses the file system hierarchy. This manipulation can cause the application to access directories and files outside the intended project directory scope. The vulnerability can be exploited remotely without requiring user interaction, but it does require low-level privileges on the system. The vendor was informed early but has not responded or released a patch, and the exploit details have been publicly disclosed, increasing the risk of exploitation. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the moderate impact on confidentiality, integrity, and availability, with no need for user interaction and low attack complexity. Although no active exploitation has been reported, the exposure of sensitive files or configuration data could facilitate further attacks or data breaches.

If exploited, this vulnerability allows attackers to access files and directories outside the intended project directory, potentially exposing sensitive information such as configuration files, credentials, or source code. This unauthorized access can compromise confidentiality and integrity of data. Additionally, attackers might leverage the information gained to escalate privileges or execute further attacks within the environment. For organizations relying on DataLinkDC dinky for project management or development workflows, this could lead to intellectual property theft, disruption of services, or compliance violations. The lack of vendor response and patch increases the window of exposure, making timely mitigation critical. While the vulnerability does not directly allow remote code execution, the information disclosure and potential for lateral movement pose significant risks.

Organizations should immediately audit their use of DataLinkDC dinky and identify any installations running affected versions (1.2.0 through 1.2.5). Until an official patch is released, implement strict input validation and sanitization on the projectName parameter at the application or proxy level to block path traversal characters such as '../'. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious path traversal attempts. Restrict file system permissions for the dinky application to the minimum necessary, preventing it from accessing sensitive directories outside its intended scope. Monitor logs for unusual access patterns or attempts to exploit path traversal. Consider isolating or sandboxing the application to limit potential damage. Engage with the vendor for updates and apply patches promptly once available. Additionally, review and strengthen overall access controls and network segmentation to reduce exposure.