CVE-2026-3051 | DataLinkDC dinky up to 1.2.5 Project Name GitRepository.java getProjectDir projectName path traversal

A vulnerability described as critical has been identified in DataLinkDC dinky up to 1.2.5. The affected element is the function getProjectDir of the file dinky-admin/src/main/java/org/dinky/utils/GitRepository.java of the component Project Name Handler. Such manipulation of the argument projectName leads to path traversal.

This vulnerability is listed as CVE-2026-3051. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.