Blinko Path Traversal Vulnerability in Plugin File Server Endpoint

A path traversal vulnerability has been identified in Blinko versions through 1.8.3. The issue arises in the plugin file server endpoint, where the server concatenates file paths using the join() function without properly validating whether the resulting path resides within the designated plugins directory. This oversight allows for unauthorized access to arbitrary files within the plugins directory.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary file read within the plugins directory.