The vulnerability occurs in the PackagePersister.validate_tgz method of BOSH, where a shell command is constructed using a package name derived from release.MF inside an uploaded tarball. The command string "tar -tf #{tgz} 2>&1" is executed via /bin/sh without applying Shellwords.escape or equivalent sanitization. Although a validation regex (VALID_ID) exists to restrict package names to a safe pattern, this validation is performed after the shell command execution in create_package, allowing malicious input to reach the shell command and potentially execute arbitrary OS commands. This affects all BOSH versions prior to v282.1.12, which contains the fix.

Successful exploitation could allow an attacker with appropriate privileges to execute arbitrary OS commands on the system running BOSH by injecting malicious input into the package name field. This could lead to system compromise or unauthorized actions. The CVSS 4.0 score of 8.7 reflects high impact with local attack vector, high complexity, and required privileges. No known exploits in the wild have been reported at this time.

A fix is available in BOSH version v282.1.12 and later. Users should upgrade to this version or newer to remediate the vulnerability. Since no other remediation level or temporary fix is indicated, upgrading is the recommended action. Patch status is confirmed by the version information in the description. Until upgraded, avoid processing untrusted tarballs or package uploads that could contain malicious package names.