Akamai Cli
Monthly
Path traversal in Akamai CLI releases before 2.0.6 lets a malicious package write files outside the CLI install directory, because commands[].name values read from a package's cli.json are concatenated into an output filename without validation. Exploitation is conditional and user-driven: an attacker must control or compromise a package source and convince a victim to install or update it (UI:P, PR:N unauthenticated in the sense that no prior credentials are needed), after which '..' segments in a command name can overwrite executables on the user's PATH and persist after the package is uninstalled. This is assessed as a moderate, conditional-execution risk rather than a mass-exploitable emergency; a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation was reported at time of analysis.
Path traversal in Akamai CLI releases before 2.0.6 lets a malicious package write files outside the CLI install directory, because commands[].name values read from a package's cli.json are concatenated into an output filename without validation. Exploitation is conditional and user-driven: an attacker must control or compromise a package source and convince a victim to install or update it (UI:P, PR:N unauthenticated in the sense that no prior credentials are needed), after which '..' segments in a command name can overwrite executables on the user's PATH and persist after the package is uninstalled. This is assessed as a moderate, conditional-execution risk rather than a mass-exploitable emergency; a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation was reported at time of analysis.