{"id":"CVE-2026-41009","summary":"Local Blobstore may allow arbitrary reads/deletes","details":"When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value']['result']['compile_log_id'] and format_exception (line 318-325) reads exception['blobstore_id']; both pass the agent-supplied string unmodified to download_and_delete_blob(blob_id) (line 344-349), which calls @resource_manager.get_resource(blob_id) and, in an ensure block, @resource_manager.delete_resource(blob_id). Api::ResourceManager forwards the id straight to blobstore.get(id) / blobstore.delete(id). When the director is configured with the local blobstore provider, Blobstore::LocalClient#object_file_path(oid) is File.join(@blobstore_path, oid) (local_client.rb:54-56) with no normalisation, so oid = \"../../jobs/director/config/director.yml\" resolves outside the blobstore root.\n\nAffected versions:\nBOSH Director: All versions prior to v282.1.12","modified":"2026-08-12T03:51:14.090665035Z","published":"2026-05-27T06:45:11.124Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41009.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"282.1.12"}]}],"cna_assigner":"vmware","cwe_ids":["CWE-22"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41009.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41009"},{"type":"ARTICLE","url":"https://www.cloudfoundry.org/blog/cve-2026-41009-local-blobstore-may-allow-arbitrary-reads-deletes/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cloudfoundry/bosh","events":[{"introduced":"0"},{"fixed":"86ee55839a6ee2ffa73e20dfe1e7622f6f91e3f6"}],"database_specific":{"cpe":"cpe:2.3:a:cloud_foundry:bosh:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"282.1.12"}],"source":"CPE_RANGE"}}],"versions":["v282.1.11","v282.1.10","v282.1.9","v282.1.8","v282.1.7","v282.1.6","v282.1.5","v282.1.4","v282.1.3","v282.1.2","v282.1.1","v282.1.0","v282.0.10","v282.0.9","v282.0.8","v282.0.7","v282.0.6","v282.0.5","v282.0.4","v282.0.3","v282.0.2","v282.0.1","v282.0.0","v281.0.1","v281.0.0","v280.1.22","v280.1.21","v280.1.20","v280.1.19","v280.1.18","v280.1.17","v280.1.16","v280.1.15","v280.1.14","v280.1.13","v280.1.12","v280.1.11","v280.1.10","v280.1.9","v280.1.8","v280.1.7","v280.1.6","v280.1.5","v280.1.4","v280.1.3","v280.1.2","v280.1.1","v280.1.0","v280.0.25","v280.0.24","v280.0.23","v280.0.22","v280.0.21","v280.0.20","v280.0.19","v280.0.18","v280.0.17","v280.0.16","v280.0.15","v280.0.14","v280.0.13","v280.0.12","v280.0.11","v280.0.10","v280.0.9","v280.0.8","v280.0.7","v280.0.6","v280.0.5","v280.0.4","v280.0.3","v280.0.2","v280.0.1","v280.0.0","v279.0.0","v278.0.0","v277.4.3","v277.4.2","v277.4.1","v277.4.0","v277.3.3","v277.3.2","v277.3.1","v277.3.0","v277.2.0","v277.1.0","v277.0.0","v276.1.1","v276.1.0","v276.0.0","v275.1.0","v275.0.0","v274.4.0","v274.3.0","v274.2.0","v274.1.0","v274.0.0","v273.1.0","v273.0.0","v272.6.0","v272.5.0","v272.4.0","v272.3.0","v272.2.0","v272.1.0","v272.0.0","v271.20.0","v271.19.0","v271.18.0","v271.17.0","v271.16.0","v271.15.0","v271.14.0","v271.13.0","v271.12.0","v271.11.0","v271.10.0","v271.9.0","v271.8.0","v271.7.0","v271.6.0","v271.5.0","v271.4.0","v271.3.0","v271.2.0","v271.1.0","v271.0.0","v270.12.0","v270.11.0","v270.10.0","v270.9.0","v270.8.0","v270.7.0","v270.6.0","v270.5.0","v270.4.0","v270.3.0","v270.2.0","v270.1.1","v270.1.0","v270.0.0","v269.0.0","v268.7.0","v268.6.0","v268.5.0","v268.4.0","v268.2.1","v268.3.0","v264.1","v261.2","scotty_09012012"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41009.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:L"}]}