CVE-2026-2623

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw has been found in Blossom up to 1.17.1. This issue affects the function put of the file blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/BLOSManager.java of the component File Upload. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
n/aBlossom1.17.0; 1.17.1

References

Timeline

Published
Feb 17, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-262303.8Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allowsCVE-2026-262318.5Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that tCVE-2026-262329.1Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.CVE-2026-262336.5Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allowsCVE-2026-262348.8JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override requeCVE-2026-262357.5JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or rebCVE-2026-262367.5A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to accessCVE-2026-262377.5A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to accessCVE-2026-262398.1A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploitCVE-2026-26249.8Missing Authentication for Critical Function vulnerability in ePati Cyber ​​Security Technologies Inc. Antikor Next Generation Firewall (NGFCVE-2026-262409.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modifCVE-2026-262419.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif