CVE-2026-41011

PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z_+.]+$/i) would reject the name, but in create_package (lines 74–79) the shell-out in save_package_source_blob runs before package.save, so validation fires too late. Affected versions: - BOSH: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later

• CWE-78

• https://www.cloudfoundry.org/blog/cve-2026-41011-package-name-command-injection/

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41006Spring HATEOAS's internal PropertyUtils.createObjectFromProp…7.5
• CVE-2026-41007Spring HATEOAS maintains an unbounded static cache of String…7.5
• CVE-2026-41008Spring Security Authorization Server's authorization endpoin…6.1
• CVE-2026-41009When the director sends a long-running request (e.g. compile…5.8
• CVE-2026-4101IBM Verify Identity Access Container 11.0 through 11.0.2 and…9.8
• CVE-2026-41010ReleaseJob#unpack builds job_dir = File.join(@release_dir, '…8.7
• CVE-2026-41013Input validation bypass in SMB volume mount handling in Clou…8.1
• CVE-2026-41014The partitioned_dag_runs endpoints in the Airflow UI enforce…4.3
• CVE-2026-41015radare2 before 9236f44, when configured on UNIX without SSL,…7.4
• CVE-2026-41016Apache Airflow's SMTP provider `SmtpHook` called Python's `s…5.9
• CVE-2026-41017Apache Airflow's `JWTRefreshMiddleware` set the JWT auth coo…5.9
• CVE-2026-41018The Elasticsearch logging provider, when configured with a `…6.5