CVE-2026-41011
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-78
Neutralización incorrecta de elementos especiales usados en un comando de sistema operativo (Inyección de comando de sistema operativo)
Fecha de publicación:
04/06/2026
Última modificación:
04/06/2026
Descripción
*** Pendiente de traducción *** PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, &#39;packages&#39;, "#{name}.tgz") and name = package_meta[&#39;name&#39;] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late.<br />
<br />
Affected versions:<br />
- BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later
Impacto
Puntuación base 4.0
8.70
Gravedad 4.0
ALTA
Puntuación base 3.x
8.20
Gravedad 3.x
ALTA