---
id: "CVE-2026-82518"
page: "https://infrastack.ai/live/CVE-2026-82518"
kind: "vulnerability"
aliases: ["CVE-2026-82518"]
title: "Akamai CLI: malicious packages can overwrite files outside install directory"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["akamai-cli", "ci", "developer-workstations", "other"]
not_affected_if: ["no-third-party-packages", "version-2.0.6-or-later"]
published_at: "2026-11-10T17:17:48+00:00"
first_seen_at: "2026-11-10T17:22:44+00:00"
updated_at: "2026-11-10T17:23:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82518", "first_seen_at": "2026-11-10T17:22:44+00:00"}]
exploit_sources: []
---

# Akamai CLI: malicious packages can overwrite files outside install directory

Link for people: https://infrastack.ai/live/CVE-2026-82518 (this .md is for agents)

Akamai CLI before 2.0.6 does not validate command names in a package's cli.json, so a crafted package can use '..' path segments to write files outside its install directory. An attacker who gets a victim to install or update such a package can overwrite executables on the victim's PATH, and the overwrite survives uninstalling the package.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `akamai --version` and confirm the installed version is below `2.0.6`.
- Review any third-party Akamai CLI packages installed on developer machines for unexpected `commands[].name` values in their `cli.json`.

## Fix

- Akamai CLI: move to `2.0.6` or later.

## Timeline

- 2026-11-10T17:22:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82518

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/akamai-cli-before-2.0.6-path-traversal-via-cli-json-command-names
- [fix] Patch: github.com https://github.com/akamai/cli/commit/03cf2e4d7db3680ee8230aa399697d74b0ec5244
- [fix] Release notes: github.com https://github.com/akamai/cli/releases/tag/v2.0.6

## From the sources

Akamai CLI before 2.0.6 contains a path traversal vulnerability that allows malicious packages to write files outside the install directory via unvalidated commands[].name values in cli.json. Attackers who convince victims to install or update a package can use '..' segments to overwrite executables on the user's PATH, persisting after uninstall.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_