CVE-2026-41010: OS Command Injection
ReleaseJob#unpack builds jobdir = File.join(@releasedir, 'jobs', name) and jobtgz = File.join(@releasedir, 'jobs', "#{name}.tgz") where name returns @jobmeta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{jobdir} -xf #{jobtgz} 2>&1", :onerror => :return). Bosh::Common::Exec.sh executes via %x{#{command}} (bosh-common/lib/bosh/common/exec.rb:53), i.e. /bin/sh -c, so any shell metacharacters in name are interpreted. FileUtils.mkdirp(jobdir) on line 49 creates the literal directory (no shell) and succeeds even when the name contains $()/;, so execution reaches the sh call.
Affected versions: - BOSH Director: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BOSH Directorto a version that resolves this vulnerability.Fixed in v282.1.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41010?
The severity of CVE-2026-41010 is high with a score of 8.2.
What type of vulnerability is CVE-2026-41010?
CVE-2026-41010 is categorized as an OS Command Injection vulnerability.
How can CVE-2026-41010 be exploited?
CVE-2026-41010 can be exploited by an attacker supplying a crafted release.MF file that triggers command execution.
What are the potential impacts of CVE-2026-41010?
The potential impacts of CVE-2026-41010 include unauthorized command execution with potential data exposure and system compromise.
How do I fix CVE-2026-41010?
To fix CVE-2026-41010, you should update the Cloud Foundry BOSH Director to a version that addresses this vulnerability.