CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

<p>Posted by Richard Zowalla on Sep 13</p>Severity: important <br /> <br /> Affected versions:<br /> <br /> - Apache Storm Nimbus (org.apache.storm:storm-server) 3.0.0 before 3.1.0<br /> <br /> Description:<br /> <br /> Description<br /> <br /> A topology&apos;s `topology.blobstore.map` lets the submitter choose a local name for each blob that the<br /> supervisor localises. That name was used to