PT-2026-43566 · Cloud Foundry Foundation · Bosh Director

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-41009

Mitre

CVSS v3.1

5.8

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:L

When the director sends a long-running request (e.g. compile package), the agent's reply JSON is consumed by AgentClient. inject compile log (line 332-339) reads response['value']['result']['compile log id'] and format exception (line 318-325) reads exception['blobstore id']; both pass the agent-supplied string unmodified to download and delete blob(blob id) (line 344-349), which calls @resource manager.get resource(blob id) and, in an ensure block, @resource manager.delete resource(blob id). Api::ResourceManager forwards the id straight to blobstore.get(id) / blobstore.delete(id). When the director is configured with the local blobstore provider, Blobstore::LocalClient#object file path(oid) is File.join(@blobstore path, oid) (local client.rb:54-56) with no normalisation, so oid = "../../jobs/director/config/director.yml" resolves outside the blobstore root.

Affected versions: BOSH Director: All versions prior to v282.1.12

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41009

Affected Products

Bosh Director

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-41009 · Security Note
• https://cloudfoundry.org/blog/cve-2026-41009-local-blobstore-may-allow-arbitrary-reads-deletes · Note