CVE-2026-41010
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In BOSH Director (all versions prior to v282.1.12), the ReleaseJob#unpack function builds job_dir and job_tgz paths using a name from the attacker-supplied release.MF file. These paths are interpolated into a shell command without proper escaping, allowing shell command injection via metacharacters in the name. An attacker can execute arbitrary commands in the context of BOSH Director.
Risk Assessment
Shell command injection can lead to full compromise of BOSH Director, threatening the entire infrastructure managed by BOSH.
Recommendation
Update BOSH Director to version v282.1.12 or later, which includes a fix for command injection.
Other vulnerabilities in BOSH Director
See all- CVE-2026-41704Medium
CVE-2026-41704 affects BOSH Director, where the AgentClient#handle_method processes NATS replies, leading to unauthorized access to resources in the blobstore. The lack of proper checks, such as UUID format validation, ownership verification, and namespace prefix checks, allows unauthorized deletion of resources.
- CVE-2026-41009Medium
CVE-2026-41009 affects BOSH Director, where the agent's response to long-running requests may lead to unauthorized access to system files. Due to the lack of normalization of the blob identifier, it is possible to reference files outside the blobstore root.
Original NVD description (English source)
ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :on_error => :return). Bosh::Common::Exec.sh executes via %x{#{command}} (bosh-common/lib/bosh/common/exec.rb:53), i.e. /bin/sh -c, so any shell metacharacters in name are interpreted. FileUtils.mkdir_p(job_dir) on line 49 creates the literal directory (no shell) and succeeds even when the name contains $()/;, so execution reaches the sh call. Affected versions: - BOSH Director: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later