The vulnerability occurs in BOSH Director when handling long-running requests such as compile_package. The agent's JSON reply includes blob IDs that are passed without path normalization to the local blobstore client. Specifically, Blobstore::LocalClient constructs file paths by joining the blobstore root path with the blob ID directly, allowing a crafted blob ID containing path traversal sequences (e.g., "../../jobs/director/config/director.yml") to access files outside the blobstore directory. This improper limitation of pathname to a restricted directory (CWE-22) can lead to unauthorized file access or deletion. The issue affects all BOSH Director versions before v282.1.12. The CVSS 4.3 vector indicates local attack vector, high attack complexity, partial privileges required, and partial user interaction.

An attacker with high privileges and the ability to interact with the director can exploit this vulnerability to read or delete arbitrary files on the system where the local blobstore is configured. This could lead to unauthorized disclosure or modification of sensitive configuration files, potentially impacting system integrity and availability. The vulnerability does not affect cloud-hosted services and requires local access with elevated privileges.

No official patch or remediation level has been published by the vendor as of the current information. Users should monitor the Cloud Foundry Foundation advisories for updates and apply the official fix once available. Until then, restrict access to the BOSH Director and its local blobstore to trusted administrators only. Avoid using the local blobstore provider if possible or implement additional path normalization checks as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.