CVE-2026-2623

MEDIUM

Blossom < 1.17.1 - Path Traversal via BLOSManager File Upload

Title source: llm
STIX 2.1

Description

A flaw has been found in Blossom up to 1.17.1. This issue affects the function put of the file blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/BLOSManager.java of the component File Upload. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.346274
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.346274
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.751988

Scores

CVSS v3 6.3
EPSS 0.0063
EPSS Percentile 45.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
wangyunf/blossom < 1.17.1
Published Feb 17, 2026
Tracked Since Feb 18, 2026