BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-122009DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flink_web Proxy Endpoint. This manipulation of the argument _authority causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

6.9 MEDIUMEPSS 0.50%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
6.9MEDIUM4.0VulDB (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
5.5MEDIUM4.0VulDB (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7.3HIGH3.1VulDB (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3HIGH3.1VulDB (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RC:C
7.3HIGH3.0VulDB (CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RC:C
7.5HIGH2.0VulDB (CNA)AV:N/AC:L/Au:N/C:P/I:P/A:P
7.5HIGH2.0VulDB (CNA)AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C

Details

CVE ID
CVE-2026-122009
Status
Deferred
Assigner (CNA)
VulDB
Published
Nov 4, 2026
Last modified
2026-11-04 21:18 UTC
Weaknesses
  • CWE-918 · Server-Side Request Forgery

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 08:18 UTC.