Cloud Foundry Foundation BOSH Director

• CVE-2026-41010 High 8.2 ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from 0.1%
• CVE-2026-41704 Medium 5.0 Compromised VM can make arbitrary blobstore deletes <0.1%
• CVE-2026-41009 Medium 5.8 Local Blobstore may allow arbitrary reads/deletes <0.1%