Akamai CLI CVE-2026-82518

Exploitation requires the victim to install or update an Akamai CLI package (version before 2.0.6) whose cli.json contains a commands[].name value with '..' path-traversal segments; this is the exact trigger (unvalidated command names used to build the output path in downloadBin / installGolang). The attacker must control or compromise the package source and socially engineer the victim into installing/updating it (UI:P), so there is no autonomous remote exploitation against a running service. Limiting factors: the user must initiate the install/update action, the attacker must deliver a malicious package, and fixed versions (2.0.6+) enforce an allowlist regex that rejects such names.

This is a moderate, conditional-execution risk rather than a mass-exploitable emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N) and the vuln.today 'this_week' decision label agree it is real but not top-tier urgent: the integrity impact is high (VI:H - arbitrary files written outside the install directory, including executables on the user's PATH), but it is gated by UI:P, meaning a victim must install or update a malicious package. No KEV listing and no EPSS score are present in the input, so there is no signal of active or widespread exploitation; absence of EPSS/KEV is not evidence of safety but it argues against automated mass exploitation. A public PoC reference (a GitHub gist) is cited but is not verified as working exploit code, so exploit maturity should be treated as unconfirmed. The source-code diff (PR #227 adding NormalizeCommandName with an allowlist regex) confirms the mechanism and the fix, so the vulnerability itself is well substantiated. Net: prioritize patching to 2.0.6 this week for anyone running Akamai CLI, but this is a supply-chain/social-engineering-dependent flaw, not remote unauthenticated code execution against a default service.

An attacker publishes or compromises an Akamai CLI package and places a '..'-laden value in a commands[].name entry inside cli.json. When a victim installs or updates that package, the CLI writes the package binary outside the intended install directory, overwriting an executable already on the victim's PATH; the planted file persists even after the package is uninstalled. A public PoC reference (gist) exists but is not verified as working exploit code, and successful exploitation requires the victim to perform the install/update (UI:P).