PT-2026-46131 · Bosh · Bosh

CVE-2026-41011 · Published 2026-06-04 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BOSH versions prior to 282.1.12

Description An issue exists in the PackagePersister.validate tgz function where a shell command is constructed using the name variable, which is derived from the release.MF file within an uploaded tarball. This string is passed to Bosh::Common::Exec.sh and executed via /bin/sh -c without the use of Shellwords.escape, allowing for potential command injection. Although a validation regex exists in Models::Package, the shell execution in save package source blob occurs before the package.save method is called, rendering the validation ineffective.

Recommendations Update to version 282.1.12 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-41011

Affected Products

Bosh

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-41011 · Security Note
• https://t.me/CVEtracker/55787 · Telegram Post
• https://t.me/cveNotify/213332 · Telegram Post
• https://twitter.com/CVEnew/status/2062404815821648042 · Twitter Post
• https://t.me/cveNotify/165902 · Telegram Post
• https://cloudfoundry.org/blog/cve-2026-41011-package-name-command-injection · Note