An unauthenticated file upload vulnerability in Dinky allows remote attackers to write arbitrary files and execute code by leveraging a hardcoded default token.

This is an unrestricted file upload vulnerability occurring in the /download/uploadFromRsByLocal handler. The application fails to validate file paths and relies on a hardcoded authentication token, allowing unauthenticated attackers to overwrite critical application files and achieve code execution.

Successful exploitation allows an attacker to write files to the application directory with the privileges of the Dinky service account. This enables the attacker to modify application logic, inject malicious scripts into the interface, or execute arbitrary code at the next service restart. Given the CVSS score of 9.8, this vulnerability poses a severe threat to service availability, data integrity, and the overall security posture of the host system.

Immediate Action: Update to the latest version of Dinky and ensure that the default authentication token is changed immediately upon deployment.

Proactive Monitoring: Monitor the /opt/dinky directory and its subdirectories for unexpected file modifications or the creation of new, unrecognized files.

Compensating Controls: Restrict network access to the Dinky HTTP port (8888) to trusted IP addresses only and place the application behind a secure proxy that enforces strong authentication.

Public Exploit Available: Unknown

The reliance on a hardcoded, publicly known token combined with unrestricted file uploads creates a critical security risk. Users of Dinky must update their installations and change all default credentials immediately. Given the ease of exploitation, this should be treated as a high-priority remediation task for all deployments.