Advisory [CVE-2026-82427] Apache Storm: Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises

A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises.

That name was used to build a path under the topology's working directory without normalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper

force-deletes whatever already exists at the target before creating the link.

A submitter could therefore use `../` segments to direct that delete-and-symlink operation at an arbitrary path, as the supervisor user, on every node the topology is scheduled onto.

The consequences include recursive deletion of supervisor-owned content and planting a symlink that causes a subsequent worker

launch to execute attacker-chosen code as another tenant's operating-system user, which defeats the isolation that `supervisor.run.worker.as.user` is intended to provide.

Affected product named by the advisory: Apache Storm.