PT-2026-20340 · Blossom · Blossom

Xcxr · Published 2026-02-17 · Updated 2026-02-18 · CVE-2026-2622

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Blossom versions up to 1.17.1

Description A flaw exists in Blossom that allows for cross site scripting. The issue is located within the Article Title Handler component, specifically in the ArticleController.java file and its content function. The exploit is publicly available and can be launched remotely. The vendor was notified but did not respond.

Recommendations Versions prior to 1.17.1 should be updated. As a temporary workaround, consider restricting access to the content function within the ArticleController.java file until a patch is available.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-2622

Affected Products

Blossom

References · 8

• 🔥 https://fx4tqqfvdw4.feishu.cn/docx/AXa1dpliBomr2Ox6dYJc6jJInEb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2622 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2622 · Vendor Advisory
• https://twitter.com/CVEnew/status/2023901977717956877 · Twitter Post
• https://t.me/CVEtracker/44912 · Telegram Post
• https://vuldb.com/?id.346273 · Note
• https://vuldb.com/?submit.751987 · Note
• https://vuldb.com/?ctiid.346273 · Note