Cloud Foundry BOSH Director up to 282.1.11 Exec.sh File.join os command injection

Summaryinfo

A vulnerability, which was classified as critical, was found in Cloud Foundry BOSH Director up to 282.1.11. This affects the function File.join of the file Exec.sh. The manipulation results in os command injection. This vulnerability is cataloged as CVE-2026-41010. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Cloud Foundry BOSH Director up to 282.1.11. Affected is the function File.join of the file Exec.sh. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :on_error => :return). Bosh::Common::Exec.sh executes via %x{#{command}} (bosh-common/lib/bosh/common/exec.rb:53), i.e. /bin/sh -c, so any shell metacharacters in name are interpreted. FileUtils.mkdir_p(job_dir) on line 49 creates the literal directory (no shell) and succeeds even when the name contains $()/;, so execution reaches the sh call. Affected versions: - BOSH Director: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later

The advisory is shared for download at cloudfoundry.org. This vulnerability is traded as CVE-2026-41010 since 04/16/2026. The exploitability is told to be easy. The attack needs to be approached locally. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 282.1.12 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Cloud Foundry

Name

• BOSH Director

Version

• 282.1.0
• 282.1.1
• 282.1.2
• 282.1.3
• 282.1.4
• 282.1.5
• 282.1.6
• 282.1.7
• 282.1.8
• 282.1.9
• 282.1.10
• 282.1.11

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion