VYPR

BOSH Director

by BOSH

CVEs (1)

  • CVE-2026-41010HigJun 4, 2026
    risk 0.53cvss 8.2epss

    ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded…