Critical

Arbitrary File Write in DataLinkDC Dinky uploadFromRsByLocal

IdentifiersCVE-2026-70558CWE-434· Unrestricted Upload of File with…

CVE-2026-70558 is a critical arbitrary file write vulnerability in DataLinkDC Dinky affecting version 1.2.5 and the development branch. The flaw is in the POST /download/uploadFromRsByLocal handler, which accepts a caller-controlled path parameter and passes it directly to file creation and transfer operations without validating or constraining the destination path. The vulnerable route is excluded from normal Sa-Token protections through @SaIgnore and /download/** interceptor exclusion, leaving only a header equality check against a dinkyToken value. Because the default token is hardcoded in source and shipped with deployments, a remote attacker who can reach the exposed HTTP service can supply that token and write arbitrary files as the Dinky service account. In default Docker deployments, writable application directories allow attackers to overwrite static assets for stored client-side script injection and replace application classes or related files to achieve code execution when the JVM is restarted.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthenticated remote arbitrary file write as the Dinky service account. This can be used to modify application content, inject malicious JavaScript into pages viewed by administrators, tamper with launch or application files, and obtain code execution under the service account on a subsequent JVM restart. Because the process does not run as root, impact is constrained by the service account's filesystem permissions, but in default deployments writable application directories still permit high-impact integrity compromise and likely confidentiality and availability consequences.

Mitigation

If you can’t patch tonight, do this now.

Until a fixed release is deployed, do not expose the Dinky HTTP service directly to untrusted networks. Place it behind a trusted reverse proxy, firewall, or network ACLs that restrict access to authorized administrators only. Disable or block access to the /download/uploadFromRsByLocal endpoint if operationally feasible. Replace any default token value with a unique secret if the product permits it. Harden the runtime environment so application directories are not writable by the Dinky service account, especially in containerized deployments.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-fixed release when available. If patching locally, the vulnerable handler should be changed to validate and canonicalize destination paths and restrict writes to an intended safe directory. The /download/** routes should be brought back under proper authentication and authorization controls, and the hardcoded default token behavior should be removed in favor of a unique deployment-specific secret. Filesystem and container permissions should also be hardened so the service account cannot write to application classpath locations, launch scripts, or static asset directories.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationDinkyapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

cvefeed high severityNews

Aug 6, 2026

CVE-2026-70558 - Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token

An arbitrary file write vulnerability in DataLinkDC Dinky caused by unsafe handling of a caller-supplied path in the /download/uploadFromRsByLocal endpoint, combined with a hardcoded default token and insufficient access controls. It can allow remote attackers to write files as the Dinky service account and potentially achieve code execution on restart.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5