EUVD-2026-54219
GHSA-hr6c-84vf-jf53
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Adjacent vector reflects IaaS-metadata-only exposure; AC:H for the specific tenant-level metadata access required; I:L and A:L because write is path-suffix-constrained with partial body control.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
2DescriptionCVE.org
Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu.
Affected versions: BOSH agent < v2.847.0 (jammy <= v1.1202, or noble <= v1.364). Lower bound unspecified in advisory ("All bosh agent versions").
AnalysisAI
Path traversal in the BOSH agent on Ubuntu allows an attacker positioned to manipulate IaaS metadata to cause the agent to write a root-owned file with partially attacker-controlled content to any filesystem path ending in '.network', while also creating missing parent directories with insecure 0777 permissions. All BOSH agent versions prior to v2.847.0 on Ubuntu jammy (<=v1.1202) and noble (<=v1.364) are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must control or manipulate the IaaS metadata layer accessible to the target BOSH-managed VM (e.g., AWS EC2 user-data, GCP instance metadata, or equivalent). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.2 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects an adjacent-network attack requiring high complexity, which significantly constrains real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the BOSH agent to v2.847.0 or later; on Ubuntu jammy, deploy a stemcell newer than v1.1202, and on Ubuntu noble, deploy a stemcell newer than v1.364. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today