CVE-2026-2623

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-2623

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2623.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-2623

Published

2026-02-17T21:02:39.562Z

Modified

2026-08-12T03:51:47.234513516Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Blossom File Upload BLOSManager.java put path traversal

Details

A flaw has been found in Blossom up to 1.17.1. This issue affects the function put of the file blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/BLOSManager.java of the component File Upload. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.17.0"
                },
                {
                    "last_affected": "1.17.0"
                },
                {
                    "introduced": "1.17.1"
                },
                {
                    "last_affected": "1.17.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2623.json"
}

References

Affected packages

Git / github.com/blossom-editor/blossom

Affected ranges

Type

GIT

Repo

https://github.com/blossom-editor/blossom

Events

Introduced

Last affected

0d47cc248d59b68e0b85ee4f5cd8cd3c6c573d92

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.17.1"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:*"
}

Affected versions

v.*

v.1.10.0

v1.*

v1.0.0

v1.1.0

v1.11.0

v1.12.0

v1.13.0

v1.14.0

v1.15.0

v1.16.0

v1.17.0

v1.17.1

v1.2.0

v1.3.0

v1.4.0

v1.4.1

v1.5.0

v1.6.0

v1.7.0

v1.7.1

v1.7.2

v1.8.0

v1.8.1

v1.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2623.json"