CVE-2026-41010

Name of the Vulnerable Software and Affected Versions BOSH Director versions prior to 282.1.12

Description The ReleaseJob#unpack function constructs file paths using the name variable, which is retrieved from the jobs: array within an attacker-supplied release.MF file inside an uploaded tarball. These paths are interpolated into a shell string and executed via Bosh::Common::Exec.sh(), which utilizes /bin/sh -c. Because shell metacharacters in the name variable are interpreted, this allows for arbitrary command execution. The FileUtils.mkdir p() function creates the directory literally, allowing the process to reach the shell execution call even when the name contains characters such as $()/;.

Recommendations Update to version 282.1.12 or later.