The vulnerability arises from BOSH Director’s handling of compile_package responses. The agent returns a blob ID that BOSH Director trusts and forwards unchanged to the blobstore client for download_and_delete_blob. When the blobstore is local, the ID is interpreted as a file path without normalization. An attacker who can influence the agent’s blob ID can cause BOSH to open or delete files outside the blobstore root, exposing sensitive files such as director.yml or other configuration data. The flaw represents a classic path‑traversal (CWE‑22) that allows arbitrary reading and deletion of files on the host running the director.

Affected systems are Cloud Foundry Foundation’s BOSH Director before version 282.1.12. All releases prior to 282.1.12 are vulnerable; versions 282.1.12 and later contain the patch that normalizes blob identifiers before use.

The CVSS base score is 4.3, indicating a moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the director’s compile_package workflow; an authenticated user who can submit a compile request can supply a crafted blob ID. Because the attack vector is local, the risk to remote attackers is limited unless the director is exposed to untrusted users. Nevertheless, the ability to read or delete sensitive configuration files can lead to privilege escalation or service disruption, warranting timely remediation.