CVE-2026-41010: ReleaseJob#unpack builds job_dir = File

Synopsis

A command injection vulnerability exists in BOSH Director (Cloud Foundry Foundation) versions prior to 282.1.12. When a user uploads a specially crafted BOSH release tarball, the job name field from the release manifest is passed unsanitized into a shell command executed by the Director, allowing shell metacharacters to be interpreted by /bin/sh. The attacker must hold an admin-level account on the Director to upload releases, but successful exploitation gives full read, write, and availability impact on both the Director and any systems it manages. A patched-image rebuild at version 282.1.12 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host, or access to the Director's API from the local system; no over-the-network exposure is required per AV:L.

• AuthenticationRequired

  An admin or privileged Director account is required to upload a BOSH release tarball; any lower-privilege credential is not sufficient (PR:H).

• Victim interactionNot required

  No action from another user or operator is needed to trigger the vulnerable code path once the malicious release is uploaded (UI:N).

• Attack complexityDetail

  Exploitation requires specific preconditions to align, such as timing or environmental factors, making reliable exploitation harder than a condition-free attack (AC:H, AT:P).

Blast Radius

• An attacker can read arbitrary files on the BOSH Director host, including credentials, release metadata, and internal configuration (VC:H).
• An attacker can write or modify files on the Director host and on systems the Director manages, including deployment manifests and job configurations (VI:H, SI:H).
• An attacker can crash or render unavailable the Director process and the systems it controls, disrupting ongoing deployments and managed VMs (VA:H, SA:H).
• Because the Director orchestrates infrastructure-level operations, lateral movement to managed BOSH-deployed VMs and their workloads is achievable from the initial foothold.