CVE-2015-5350

CVE-2015-5350 describes a high-severity vulnerability in Garden versions 0.22.0-0.329.0, specifically impacting Cloud Foundry deployments using Diego and Garden. An attacker could exploit a flaw in the garden-linux nstar executable by staging an application with a malicious custom buildpack. This allows unauthorized reading of host system files accessible to the BOSH-created vcap user, which can then be packaged into the application droplet. The CVSS score of 7.5 indicates a high-impact vulnerability with no authentication or user interaction required. There is no known exploit code publicly available, nor is there evidence of active exploitation, significant community discussion, or media coverage.