CVE-2026-2623 in Blossom
Summary
by MITRE • 02/18/2026
A flaw has been found in Blossom up to 1.17.1. This issue affects the function put of the file blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/BLOSManager.java of the component File Upload. This manipulation causes path traversal. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/21/2026
The vulnerability identified as CVE-2026-2623 represents a critical path traversal flaw within the Blossom framework version 1.17.1 and earlier. This security weakness resides in the file upload functionality of the blossom-backend component, specifically within the BLOSManager.java file at path blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/. The flaw manifests through the put function which fails to properly validate or sanitize user-supplied input during file upload operations, creating an exploitable condition that allows attackers to manipulate file system paths.
The technical implementation of this vulnerability stems from inadequate input validation mechanisms within the file upload handler. When users attempt to upload files through the affected system, the put function does not sufficiently filter or normalize file path components, enabling malicious actors to inject directory traversal sequences such as ../ or ..\ into the file names or paths. This allows attackers to write files to arbitrary locations on the server's file system, potentially leading to unauthorized file creation, modification, or even execution of malicious code. The vulnerability is classified under CWE-22 as Path Traversal, which is a well-documented weakness in software systems where user-controllable input is used to access files or directories outside the intended scope.
The operational impact of this vulnerability extends beyond simple file system manipulation, as it provides attackers with the capability to compromise the entire backend infrastructure. Remote exploitation is possible since the vulnerability can be triggered through network-based file upload interfaces, eliminating the need for local system access. The fact that an exploit has been published and is available for use significantly increases the risk exposure, as malicious actors can immediately leverage this weakness without requiring advanced technical skills to develop custom attack vectors. This type of vulnerability directly aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter and T1566.001 for Phishing, as attackers can use path traversal to establish persistent access or deliver additional payloads through compromised file systems.
Organizations utilizing affected versions of Blossom face substantial risk of data compromise, system infiltration, and potential complete system takeover. The vulnerability's remote exploitability means that attackers can target systems without physical access, making it particularly dangerous for web-facing applications. The lack of vendor response to early disclosure attempts further compounds the risk, leaving users without official patches or mitigation guidance during the vulnerability's active period. Security professionals should immediately implement network-based mitigations including web application firewalls, input validation restrictions, and access controls to prevent exploitation while awaiting official vendor patches. The vulnerability demonstrates the critical importance of proper input sanitization in file handling operations and highlights the need for comprehensive security testing of file upload functionalities in enterprise applications.