CVE-2026-41011
Severity CVSS v4.0:
HIGH
Type:
CWE-78
OS Command Injections
Publication date:
04/06/2026
Last modified:
04/06/2026
Description
PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, &#39;packages&#39;, "#{name}.tgz") and name = package_meta[&#39;name&#39;] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late.<br />
<br />
Affected versions:<br />
- BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later
Impact
Base Score 4.0
8.70
Severity 4.0
HIGH
Base Score 3.x
8.20
Severity 3.x
HIGH