8.8High
CVE-2026-47826blobs.yaml Path Traversal Allows File Writes
Description
The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected versions: BOSH CLI tool versions prior to v7.10.4.
Weakness (CWE):
CWE-22
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| cloudfoundry | bosh cli | < 7.10.4 | |
| CloudFoundry Foundation | BOSH CLI tool | < 7.10.4 |
References and patches
CPE matches (NVD) (1)
cpe:2.3:a:cloudfoundry:bosh_cli:*:*:*:*:*:*:*:*< 7.10.4