Vulnerability · Published Jul 9, 2026 · Assigned by vmware
CVE-2026-47826blobs.yaml Path Traversal Allows File Writes
High 8.8
In plain English
A high-severity security flaw in BOSH CLI tool from CloudFoundry Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)0.5%top 54.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected versions: BOSH CLI tool versions prior to v7.10.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CloudFoundry Foundation | BOSH CLI tool | 0 – before 7.10.4 |