BOSH CLI blobs.yml Path Traversal Vulnerability

Who is affected

How to fix it

BOSH CLI before v7.10.4 allowed path traversal through blobs.yml path keys, which could write or disclose unintended files during release operations. Upgrade the CLI and review release repositories and build hosts for malicious blob paths.

1. Inventory BOSH release build systems and operator machines that process blobs.yml files.
2. Upgrade BOSH CLI to v7.10.4 or later everywhere release create, upload, or blob commands run.
3. Review release repositories for blobs.yml entries containing absolute paths, dot-dot traversal, or unexpected file targets.
4. Run release operations from clean worktrees and least-privilege build accounts.
5. Remove or quarantine untrusted release repositories until blob paths are reviewed.
6. Audit build host filesystem changes and shell logs for unexpected reads or writes during vulnerable BOSH CLI runs.
7. Rotate credentials stored on affected workstations if sensitive local files may have been read.

Verify the fix

• Confirm every release build environment uses BOSH CLI v7.10.4 or later.
• Validate malicious blobs.yml path traversal entries are rejected or normalized safely.
• Confirm release repositories no longer contain suspicious blob path keys.
• Review file integrity and audit logs on build hosts used before the upgrade.
• Run a Fixnx scan and confirm release or blobstore services are not publicly exposed.

Related categories

Trusted references

FAQ