CVE-2026-2623

Blossom up to 1.17.1 contains a path traversal flaw in the put function of blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/BLOSManager.java (File Upload). This enables remote exploitation; an exploit has been published. Red Hat and PT Security documentation corrobora...

CVE-2026-2623: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in Blossom up to 1.17.1. This issue affects the function put of the file blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/BLOSManager.java of the component File Upload. This manipulation causes path traversal. The attack may be initiated remotely...