Loading story…
Cloud Foundry disclosed CVE-2026-41010, a high-severity OS command injection vulnerability in BOSH Director that can lead to code execution during release extraction. The flaw resides in ReleaseJob#unpack, where an attacker-controlled job name from release.MF inside an uploaded tarball is used to construct file paths and is then interpolated into a shell command executed through Bosh::Common::Exec.sh, which invokes /bin/sh -c.
Because shell metacharacters in the job name are interpreted by the shell, a crafted release can trigger arbitrary command execution even though FileUtils.mkdir_p creates the directory literally and does not block malicious characters before the shell call. Cloud Foundry said versions of BOSH Director prior to v282.1.12 are affected and that the issue is fixed in v282.1.12 and later, making prompt upgrades critical for environments that upload or process untrusted BOSH releases.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A command injection vulnerability in BOSH Director's ReleaseJob#unpack logic was fixed in version 282.1.12. The flaw stemmed from unsafe handling of an attacker-controlled job name from release.MF that could be interpolated into a shell command during tar extraction.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical OS command injection flaw tracked as **CVE-2026-14863** allows remote code execution in **FileRun** through its thumbnail generation workflow. The vulnerability affects FileRun up to and including **2026.2.0** and stems from attacker-controlled filenames being passed to `exec()` inside shell double quotes without proper sanitization such as `escapeshellarg()`. By uploading a file with shell command substitution in its name, such as a payload using `$()`, an authenticated attacker can trigger command execution when FileRun invokes thumbnail tools including **ffmpeg**, **ImageMagick**, **vips**, or **stl-thumb**. The issue is classified as **CWE-78** and carries a **CVSS 3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. VulnCheck reported that exploitation is possible for any authenticated user with default upload permissions and, in some deployments, may also be reachable before authentication through public file-request weblinks if an attacker knows the token. The official FileRun Docker image reportedly enables the vulnerable thumbnail extractors by default, increasing exposure for containerized deployments. Successful exploitation can provide code execution as **`www-data`**, potentially exposing all files managed by FileRun, database credentials, and broader access to the host server. **FileRun 2026.2.1** is listed as unaffected and contains the fix.
Aug 14, 2026
Atlassian disclosed a critical OS command injection vulnerability, `CVE-2026-21571`, in Bamboo Data Center and Server that can let an authenticated attacker execute arbitrary operating system commands and potentially fully compromise vulnerable CI/CD servers. The flaw carries a CVSS 4.0 score of **9.4**, requires no user interaction, and affects Bamboo Data Center versions `9.6.0`, `10.0.0`, `10.1.0`, `10.2.0`, `11.0.0`, `11.1.0`, `12.0.0`, and `12.1.0`. Atlassian warned that exploitation could impact confidentiality, integrity, availability, and downstream system security, with added risk to build pipelines, stored credentials, and software supply chains. Atlassian also reported a separate high-severity denial-of-service issue, `CVE-2026-33871`, in the bundled `io.netty:netty-codec-http2` dependency that could be abused for HTTP/2-based service disruption. The company urged organizations to patch immediately by upgrading to fixed releases, including `9.6.25` or later, `10.2.18` or later, and `12.1.6` or later, with `10.2.18 LTS` and `12.1.6 LTS` highlighted as recommended targets. Until upgrades are completed, administrators were advised to review deployed Bamboo versions and restrict network access to Bamboo administrative interfaces as a temporary mitigation.
Jun 29, 2026
Splunk disclosed and fixed **CVE-2026-20266**, a critical OS command injection flaw in the Splunk AI Toolkit's `btool` configuration helper that can let a user with the **Splunk admin role** execute arbitrary operating system commands on the underlying host. The vulnerability is classified as **CWE-78** and carries a **CVSS 9.1** score; it stems from unsafe shell execution in which dynamic parameters are concatenated into a shell-interpreted command string, potentially allowing injected commands to run with the privileges of the `splunkd` service account. The issue affects **Splunk AI Toolkit versions earlier than 5.7.4** in the 5.7.x branch and requires the AI Toolkit to be installed and active for exploitation. Splunk addressed the flaw in **version 5.7.4**, and downstream security notices have highlighted the update as part of broader Splunk security guidance. Reporting on the bug also noted similarities to **CVE-2026-20163**, pointing to a recurring risk pattern around shell interpretation in privileged Splunk components.
Jul 10, 2026