Vulnerability · Published Aug 6, 2026 · Assigned by vmware
CVE-2026-41861Arbitrary Root File Write via Path Traversal in BOSH agent
Medium 4.2
In plain English
A medium-severity path traversal in BOSH from CloudFoundry Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu. Affected versions: BOSH agent < v2.847.0 (jammy <= v1.1202, or noble <= v1.364). Lower bound unspecified in advisory ("All bosh agent versions").
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CloudFoundry Foundation | BOSH | 0 – before 2.847.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L