https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 09:49:00 +0000 https://cve.radiocsirt.org/vuln/cve-2026-41010 <p><strong>Affected:</strong> Cloud Foundry Foundation BOSH Director</p> <p>ReleaseJob#unpack builds job_dir = File.join(@release_dir, &#39;jobs&#39;, name) and job_tgz = File.join(@release_dir, &#39;jobs&#39;, &#34;#{name}.tgz&#34;) where name returns @job_meta[&#39;name&#39;], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh(&#34;tar -C #{job_dir} -xf #{job_tgz} 2&gt;&amp;1&#34;, :on_error =&gt; :return). Bosh::Common::Exec.sh executes via %x{#{command}} (bosh-common/lib/bosh/common/exec.rb:53), i.e. /bin/sh -c, so any shell metacharacters in name are interpreted. FileUtils.mkdir_p(job_dir) on line 49 creates the literal directory (no shell) and succeeds even when the name contains $()/;, so execution reaches the sh call.</p> <p>Affected versions: - BOSH Director: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later</p> <p><strong>Affected:</strong> Cloud Foundry Foundation BOSH Director</p> <p>ReleaseJob#unpack builds job_dir = File.join(@release_dir, &#39;jobs&#39;, name) and job_tgz = File.join(@release_dir, &#39;jobs&#39;, &#34;#{name}.tgz&#34;) where name returns @job_meta[&#39;name&#39;], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh(&#34;tar -C #{job_dir} -xf #{job_tgz} 2&gt;&amp;1&#34;, :on_error =&gt; :return). Bosh::Common::Exec.sh executes via %x{#{command}} (bosh-common/lib/bosh/common/exec.rb:53), i.e. /bin/sh -c, so any shell metacharacters in name are interpreted. FileUtils.mkdir_p(job_dir) on line 49 creates the literal directory (no shell) and succeeds even when the name contains $()/;, so execution reaches the sh call.</p> <p>Affected versions: - BOSH Director: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later</p> https://cve.radiocsirt.org/vuln/cve-2026-41010