PT-2026-46131 · Cloud Foundry Foundation · Bosh
Published
2026-06-04
·
Updated
2026-06-04
·
CVE-2026-41011
CVSS v3.1
8.2
High
| Vector | AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
PackagePersister.validate tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release dir, 'packages', "#{name}.tgz") and name = package meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID ID = /^[-0-9A-Za-z +.]+$/i) would reject the name, but in create package (lines 74–79) the shell-out in save package source blob runs before package.save, so validation fires too late.
Affected versions:
- BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bosh