Loading story…
A critical vulnerability tracked as CVE-2026-70558 affects DataLinkDC Dinky through version 1.2.5 and the development branch, allowing unauthenticated attackers to write arbitrary files via the POST /download/uploadFromRsByLocal endpoint. The flaw stems from the handler accepting an attacker-controlled path without validation while bypassing normal Sa-Token protections through @SaIgnore, leaving access gated only by a shipped, hardcoded default dinkyToken header value. The issue is remotely exploitable by anyone who can reach Dinky’s HTTP service on port 8888, and it has been rated CVSS 9.8 under v3.1.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-70558 was published for a critical unauthenticated arbitrary file write vulnerability in DataLinkDC Dinky's /download/uploadFromRsByLocal endpoint. The record states the flaw affects Dinky through version 1.2.5 and the development branch, and assigns CVSS 9.8 (v3.1) and 9.3 (v4.0).
A private GitHub security advisory, GHSA-2p66-w3p3-5226, was filed with the maintainers regarding the unauthenticated arbitrary file write vulnerability in Dinky. The issue affected version 1.2.5 and the tested development branch.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Digilent DASYLab received fixes for two remotely exploitable vulnerabilities, `CVE-2026-0957` and `CVE-2026-0954`, disclosed by the Zero Day Initiative as `ZDI-26-235` and `ZDI-26-236`. The flaws affect the parsing of DASYLab `DSA` and `DSB` files and stem from insufficient validation of user-supplied data, resulting in out-of-bounds writes that can let an attacker execute arbitrary code in the context of the current process. Exploitation requires user interaction, such as convincing a target to open a malicious file or visit a malicious page that triggers the vulnerable parsing logic. Both issues were assigned a `CVSS` score of `7.8`, with potential impact to confidentiality, integrity, and availability, and Digilent issued updates to remediate the vulnerabilities following coordinated disclosure; one of the findings was credited to Rocco Calvi of TecSecurity.
Jun 29, 2026
Digilent has addressed two **remote code execution** vulnerabilities in **DASYLab** that were publicly disclosed by the Zero Day Initiative as `ZDI-26-233` and `ZDI-26-234`, mapped to `CVE-2026-0955` and `CVE-2026-0956`. Both flaws stem from improper validation of user-supplied data while parsing **DSA files**, leading to an **out-of-bounds read** that can be leveraged for arbitrary code execution in the context of the current process. Exploitation requires user interaction, including opening a malicious file or visiting a malicious page, and each issue carries a **CVSS 7.8** severity rating. Digilent released updates to remediate the vulnerabilities, and both disclosures credit **Rocco Calvi of TecSecurity** for reporting the issues.
Jun 29, 2026