CVE-2026-47826

Analyzed Analyzed - Analysis Complete

Path Traversal in BOSH CLI Tool

Publication date: 2026-07-09

Last updated on: 2026-07-13

Assigner: VMware

Description

The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected versions: BOSH CLI tool versions prior to v7.10.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-09

Last Modified

2026-07-13

Generated

2026-07-29

AI Q&A

2026-07-09

EPSS Evaluated

2026-07-28

NVD

CVE-2026-47826

EUVD

EUVD-2026-42507

Affected Vendors & Products

Vendor	Product	Version / Range
cloudfoundry	bosh_cli	to 7.10.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-47826 is a high-severity vulnerability in the BOSH CLI tool, specifically in versions prior to v7.10.4. It involves a path traversal flaw in the blobs.yml file, which allows an attacker to write arbitrary files on the system.

This flaw can also enable attackers to exfiltrate sensitive information from affected systems.

Impact Analysis

This vulnerability can have serious impacts including unauthorized file writes and the potential leakage of sensitive information.

Attackers can write arbitrary files, which may lead to system compromise or persistence.
Sensitive information can be exfiltrated, leading to data breaches.

Given the high CVSS scores (8.8 for v3.0 and 8.5 for v4.0), the risk level is significant and should be addressed promptly.

Compliance Impact

The vulnerability in the BOSH CLI tool allows attackers to write arbitrary files and exfiltrate sensitive information, which could lead to unauthorized data access or data breaches.

Such unauthorized access and potential data exfiltration may impact compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding sensitive information and preventing data breaches.

Mitigating this vulnerability by upgrading to BOSH CLI tool version 7.10.4 or later is recommended to reduce the risk of non-compliance due to data exposure.

Mitigation Strategies

To mitigate the CVE-2026-47826 vulnerability, the Cloud Foundry Foundation recommends upgrading the BOSH CLI tool to version 7.10.4 or later.

Hi! I’m here to help you understand CVE-2026-47826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70