CVE-2026-2623: Blossom Path Traversal Vulnerability

CVE-2026-2623 Overview

A path traversal vulnerability has been discovered in Blossom, affecting versions up to 1.17.1. This security flaw exists in the put function within the file blossom-backend/common/common-iaas/src/main/java/com/blossom/common/iaas/blos/BLOSManager.java of the File Upload component. The vulnerability allows remote attackers to manipulate file paths, potentially enabling unauthorized access to files outside the intended directory structure.

Critical Impact

Attackers can exploit this path traversal flaw remotely to read or write files outside the designated upload directory, potentially compromising sensitive system files or injecting malicious content into the application.

Affected Products

• Blossom versions up to and including 1.17.1
• Blossom Backend BLOSManager.java File Upload Component
• Applications utilizing the common-iaas module

Discovery Timeline

• 2026-02-17 - CVE-2026-2623 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2623

Vulnerability Analysis

This path traversal vulnerability (CWE-22) affects the file upload functionality in Blossom's backend infrastructure. The flaw resides specifically in the put function of the BLOSManager.java class, which handles file storage operations within the Infrastructure-as-a-Service (IaaS) common module.

Path traversal attacks exploit insufficient validation of user-supplied input when constructing file paths. In this case, the File Upload component fails to properly sanitize filename parameters, allowing attackers to use directory traversal sequences (such as ../) to escape the intended upload directory and access arbitrary locations on the filesystem.

The vendor was contacted early about this disclosure but did not respond, indicating this vulnerability may remain unpatched in affected versions.

Root Cause

The root cause stems from improper input validation in the put function of BLOSManager.java. The file upload handler does not adequately sanitize or validate user-controlled filename parameters before using them in file path construction. This allows malicious actors to inject path traversal sequences that navigate outside the intended directory boundaries.

Attack Vector

The vulnerability is exploitable remotely via network access. An authenticated attacker with low privileges can craft malicious file upload requests containing path traversal sequences in the filename parameter. When processed by the vulnerable put function, these sequences allow the attacker to:

1. Write files to arbitrary locations on the server filesystem
2. Potentially overwrite existing configuration or application files
3. Read sensitive files if the application returns file contents or errors

The attack complexity is low, requiring only basic manipulation of the file upload request parameters. Technical details about this vulnerability can be found in the Feishu Document Resource and the VulDB advisory.

Detection Methods for CVE-2026-2623

Indicators of Compromise

• File upload requests containing path traversal sequences such as ../, ..\\, or URL-encoded variants (%2e%2e%2f)
• Unexpected files appearing in system directories outside the designated upload folder
• Unusual file write operations originating from the Blossom application process
• Web server logs showing suspicious filename patterns in upload requests

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Deploy file integrity monitoring on critical system directories to detect unauthorized modifications
• Configure application logging to capture all file upload operations including full path details
• Use SentinelOne Singularity Platform to monitor for anomalous file system access patterns from Java processes

Monitoring Recommendations

• Enable verbose logging for the BLOSManager.java component to track all file upload operations
• Monitor file system events for write operations outside the designated upload directories
• Set up alerts for failed file access attempts that may indicate path traversal probing
• Review application logs regularly for patterns indicative of exploitation attempts

How to Mitigate CVE-2026-2623

Immediate Actions Required

• Restrict network access to the Blossom file upload functionality to trusted sources only
• Implement input validation at the web server or reverse proxy level to block path traversal sequences
• Review and audit all files in the upload directory and adjacent directories for suspicious content
• Consider temporarily disabling the file upload feature if it is not business-critical

Patch Information

No vendor patch is currently available. The vendor was contacted early about this disclosure but did not respond. Organizations should monitor the VulDB advisory for updates on potential patches or alternative mitigations. Upgrading beyond version 1.17.1 when a fixed version becomes available is recommended.

Workarounds

• Implement strict filename sanitization by removing or rejecting any path separator characters (/, \) and traversal sequences from uploaded filenames
• Configure the application to use a canonical path validation approach, resolving the full path and verifying it remains within the intended directory
• Deploy a reverse proxy or WAF with rules specifically targeting path traversal attack patterns
• Restrict file system permissions for the Blossom application process to limit write access to only the designated upload directory

# Example WAF rule to block path traversal attempts (ModSecurity)
SecRule REQUEST_URI|ARGS|ARGS_NAMES "@rx (\.\./|\.\.\\)" \
    "id:100001,phase:2,deny,status:403,msg:'Path Traversal Attempt Blocked'"