The BOSH CLI tool contains a CWE-22 path traversal vulnerability in the blobs.yml path key handling. This flaw permits attackers to write arbitrary files outside intended directories and exfiltrate sensitive data. The issue affects all versions prior to 7.10.4. The vulnerability is remotely exploitable without privileges or user interaction, with high impact on confidentiality and integrity. No vendor advisory or patch information is currently provided, and no known exploits in the wild have been reported.

Successful exploitation can lead to arbitrary file write and sensitive information disclosure, impacting system confidentiality and integrity. The vulnerability is remotely exploitable without authentication or privileges, increasing risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the BOSH CLI tool and monitor for suspicious activity related to blobs.yml file handling.