A flaw exists in Blossom when the put method of BLOSManager.java processes uploaded files, allowing path traversal characters to be interpreted so that files can be written outside the intended upload directory. The vulnerability can be triggered by a remote actor through the public file‑upload interface, potentially enabling the placement of files in arbitrary locations on the server’s filesystem.

Blossom applications with versions up to and including 1.17.1 are affected. The issue resides in the blossom‑backend component com.blossom.common.iaas. Users running the impacted binaries on any operating system must be aware that uploads may be stored outside the defined directory structure.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of < 1 % suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires no prior authentication and can be carried out remotely by sending a crafted upload request containing traversal sequences. Defenders should treat this as a moderate‑risk issue but monitor for any vendor notice or exploit activity.