Threats tagged 'ghsa-25h5-x769-924v'

A path traversal vulnerability exists in DataLinkDC Dinky versions up to 1.2.5 in the Catalogue Upload component's file.getOriginalFilename function. This flaw allows remote attackers with low privileges to manipulate the filename argument to perform path traversal. Exploit code has been published. The vulnerability has a medium severity rating with a CVSS score of 5.4.