Vulnerability · Published May 27, 2026 · Assigned by vmware
CVE-2026-41009Local Blobstore may allow arbitrary reads/deletes
Medium 5.8
In plain English
A medium-severity path traversal in BOSH Director from Cloud Foundry Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value']['result']['compile_log_id'] and format_exception (line 318-325) reads exception['blobstore_id']; both pass the agent-supplied string unmodified to download_and_delete_blob(blob_id) (line 344-349), which calls @resource_manager.get_resource(blob_id) and, in an ensure block, @resource_manager.delete_resource(blob_id). Api::ResourceManager forwards the id straight to blobstore.get(id) / blobstore.delete(id). When the director is configured with the local blobstore provider, Blobstore::LocalClient#object_file_path(oid) is File.join(@blobstore_path, oid) (local_client.rb:54-56) with no normalisation, so oid = "../../jobs/director/config/director.yml" resolves outside the blobstore root. Affected versions: BOSH Director: All versions prior to v282.1.12
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloud Foundry Foundation | BOSH Director | 0 – before 282.1.12 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:L