CVE-2017-8033: Cloud Controller API filesystem traversal vulnerability
Cloud Foundry Foundation
- CAPI-release versions prior to v1.35.0
- cf-release versions prior to v268
A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially-crafted application that can write arbitrary files to the Cloud Controller VM.
Users of affected versions should apply the following mitigation or upgrade:
- Upgrade to Cloud Foundry v268  or later
- For standalone component users:
- Upgrade to CAPI-release 1.35.0 or later 
This vulnerability was responsibly reported by the GE Digital Security Team.
-  https://github.com/cloudfoundry/cf-release/releases
-  https://github.com/cloudfoundry/capi-release/releases
2017-07-19: Initial vulnerability report published