CVE-2026-70558 DataLinkDC CVE debrief

Who should care

Administrators and users of Dinky, especially those running the default Docker image or exposing the application to untrusted networks, should be aware of this critical vulnerability and take immediate action to secure their installations.

Technical summary

The Dinky application has a critical vulnerability in its POST /download/uploadFromRsByLocal handler. This endpoint passes a caller-supplied path parameter directly to new File(path) and file.transferTo(dest) without path validation. The route is not protected by the Sa-Token interceptor and relies on a header equality check against a hardcoded dinkyToken value (efda1551-7958-4e0f-80a8-dfd107df3e38). This allows an attacker who can reach Dinky's HTTP port (8888 by default) and supplies the hardcoded token to write arbitrary files as the Dinky service account. The default Docker image runs on port 8888 with no proxy or authentication and has /opt/dinky set to chmod 777, making the application's classpath, launch scripts, and static assets writable. Demonstrated impacts include overwriting /opt/dinky/config/static/index.html to serve attacker-controlled JavaScript to admin browsers and writing /opt/dinky/org/dinky/Dinky.class to execute attacker code as the Dinky service account at the next JVM start. Writes are made as uid 9999 (flink), not root, so /etc, /root, /home, and /usr are not affected.

Defensive priority

Critical vulnerability in Dinky's file upload handler allows arbitrary file writes with a hardcoded token, impacting the service account and potentially allowing code execution.

Recommended defensive actions

• Review and apply the vendor's remediation for CVE-2026-70558
• Restrict access to the Dinky HTTP port (8888 by default) to trusted sources
• Implement additional authentication and authorization mechanisms for file uploads
• Monitor for and respond to potential exploitation attempts
• Update Dinky to a version that addresses this vulnerability

Evidence notes

The CVE description details a critical vulnerability in Dinky's POST /download/uploadFromRsByLocal handler, which allows arbitrary file writes using a hardcoded token. The default Docker image configuration and lack of authentication exacerbate the issue, allowing for potential code execution as the Dinky service account.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.