CVE-2026-41011: OS Command Injection
PackagePersister.validatetgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(releasedir, 'packages', "#{name}.tgz") and name = packagemeta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALIDID = /^[-0-9A-Za-z+.]+$/i) would reject the name, but in createpackage (lines 74–79) the shell-out in savepackagesourceblob runs before package.save, so validation fires too late.
Affected versions: - BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BOSHto a version that resolves this vulnerability.Fixed in v282.1.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41011?
CVE-2026-41011 has a severity rating of 8.2, categorized as high.
What vulnerability is associated with CVE-2026-41011?
CVE-2026-41011 is associated with OS Command Injection vulnerabilities in Cloud Foundry Bosh.
How do I fix CVE-2026-41011?
To fix CVE-2026-41011, ensure that input values used in constructing command executions are properly sanitized to prevent injection.
What software is affected by CVE-2026-41011?
CVE-2026-41011 affects the Cloud Foundry Bosh software.
What mitigation strategies can be applied against CVE-2026-41011?
Mitigation strategies for CVE-2026-41011 include validating and sanitizing user inputs before processing them in command execution.