CVE-2026-41011

PackagePersister.validatetgz builds "tar -tf tgz 2&1" where tgz = File.joinreleasedir, 'packages', "name.tgz" and name = packagemeta'name' comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x — i.e., /bin/sh -c. No...

PT-2026-46131

Name of the Vulnerable Software and Affected Versions BOSH versions prior to 282.1.12 Description An issue exists in the PackagePersister.validate tgz function where a shell command is constructed using the name variable, which is derived from the release.MF file within an uploaded tarball. This...