CVE-2026-82518 · Other
NO FIX YET · SEE WHAT TO DO
Akamai CLI before 2.0.6 does not validate command names in a package's cli.json, so a crafted package can use '..' path segments to write files outside its install directory. An attacker who gets a victim to install or update such a package can overwrite executables on the victim's PATH, and the overwrite survives uninstalling the package.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone who installs or updates Akamai CLI packages on a workstation or CI host running a version before 2.0.6. Teams that do not use Akamai CLI, or run only the current release, can skip it.
Not affected if no-third-party-packages, version-2.0.6-or-later
Who cares akamai-cli, ci, developer-workstations
akamai --version and confirm the installed version is below 2.0.6.commands[].name values in their cli.json.2.0.6 or later.Akamai CLI before 2.0.6 contains a path traversal vulnerability that allows malicious packages to write files outside the install directory via unvalidated commands[].name values in cli.json. Attackers who convince victims to install or update a package can use '..' segments to overwrite executables on the user's PATH, persisting after uninstall.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.