CVE-2026-47826

CriticalCVSS 9.1

Published: 09/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

A path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information via the blobs.yml file. Affected versions are prior to v7.10.4.

Risk Assessment

An attacker could overwrite critical configuration files or inject malicious scripts, leading to system compromise or data theft.

Recommendation

Immediately upgrade BOSH CLI to version v7.10.4 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected versions: BOSH CLI tool versions prior to v7.10.4.