{"id":"CVE-2026-41861","aliases":["EUVD-2026-54219","GHSA-hr6c-84vf-jf53"],"status":"published","title":"Arbitrary Root File Write via Path Traversal in BOSH agent","description":"Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu.\n\n\n\nAffected versions: BOSH agent \u003c v2.847.0 (jammy \u003c= v1.1202, or noble \u003c= v1.364). Lower bound unspecified in advisory (\"All bosh agent versions\").","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00213,"percentile":0.11659,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-08-06T18:29:26Z","modified":"2026-10-23T22:10:00Z","products":[{"vendor":"cloud foundry","product":"bosh"},{"vendor":"cloudfoundry foundation","product":"bosh"}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-41861-arbitrary-root-file-write-via-path-traversal-in-bosh-agent/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41861"},{"url":"https://www.cloudfoundry.org/blog/cve-2026-41861-arbitrary-root-file-write-via-path-traversal-in-bosh-agent"},{"url":"https://github.com/advisories/GHSA-hr6c-84vf-jf53"}],"sources":{"cve":[{"id":"CVE-2026-41861","title":"Arbitrary Root File Write via Path Traversal in BOSH agent","description":"Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu.\n\n\n\nAffected versions: BOSH agent \u003c v2.847.0 (jammy \u003c= v1.1202, or noble \u003c= v1.364). Lower bound unspecified in advisory (\"All bosh agent versions\").","status":"published","published":"2026-08-06T18:29:26.213Z","modified":"2026-08-07T01:09:37.588Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-54219","description":"Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu.\n\n\n\nAffected versions: BOSH agent \u003c v2.847.0 (jammy \u003c= v1.1202, or noble \u003c= v1.364). Lower bound unspecified in advisory (\"All bosh agent versions\").","status":"published","published":"2026-08-06T18:29:26Z","modified":"2026-08-07T01:09:37Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-hr6c-84vf-jf53","title":"Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write...","description":"Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu.\n\n\n\nAffected versions: BOSH agent \u003c v2.847.0 (jammy \u003c= v1.1202, or noble \u003c= v1.364). Lower bound unspecified in advisory (\"All bosh agent versions\").","status":"published","published":"2026-08-07T00:31:18Z","modified":"2026-08-07T00:31:26Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:10:10.387883Z"}],"nvd":[{"id":"CVE-2026-41861","description":"Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu.\n\n\n\nAffected versions: BOSH agent \u003c v2.847.0 (jammy \u003c= v1.1202, or noble \u003c= v1.364). Lower bound unspecified in advisory (\"All bosh agent versions\").","status":"published","published":"2026-08-06T22:17:04.92Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:35.386166Z"}]}}