CVE-2026-2623

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw has been found in Blossom up to 1.17.1. This issue affects the function put of the file blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/BLOSManager.java of the component File Upload. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-262303.8Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows CVE-2026-262318.5Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that t CVE-2026-262329.1Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.CVE-2026-262336.5Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows CVE-2026-262348.8JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override reque CVE-2026-262357.5JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reb CVE-2026-262367.5A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access CVE-2026-262377.5A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access CVE-2026-262398.1A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2026-26249.8Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGF CVE-2026-262409.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif CVE-2026-262419.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif