CVE-2026-70559 is a high-severity vulnerability in Dinky's SysConfigController that allows unauthenticated remote attackers to obtain the full live system configuration, including sensitive credentials. The vulnerability affects Dinky v1.2.5 and the development branch. Operators and administrators of Dinky instances should assess exposure and prioritize remediation due to the high severity of the vulnerab [truncated]
The Dinky application has a critical vulnerability in its POST /download/uploadFromRsByLocal handler, allowing arbitrary file writes with a hardcoded token. This affects Dinky v1.2.5 and the development branch. The default Docker image runs on port 8888 with no proxy or authentication and chmod 777 on /opt/dinky, making the application's classpath, launch scripts, and static assets writable. Writes are ma [truncated]
