Jenkins: path traversal in file parameter names writes arbitrary files on the controller filesystem

Impact

File parameter names are checked improperly for traversal, so a user who can configure and run a job can make an uploaded file land outside the workspace, anywhere the Jenkins user has write access. This is a privilege boundary failure between job owners and the controller administrator: in a multi-team GPU shop where each team configures its own training and image-build pipelines but nobody is supposed to own the controller, any of those team members can drop files into controller-owned paths. The controller typically holds registry credentials and cluster kubeconfigs, so file write there is worth treating as a route toward controller compromise. Jenkins scores it 4.3, integrity only; the advisory does not claim code execution.

Who can reach it

Authenticated Jenkins user holding Item/Configure and Item/Build on any job. No agent access and no administrator rights required.

What to do

Upgrade to a Jenkins weekly release after 2.575 or LTS after 2.568.1 per SECURITY-3927 in the 2026-08-05 advisory - the same upgrade that covers SECURITY-3930. Cost is a controller restart: the queue pauses, agents reconnect, running builds are lost unless drained. In the meantime, tightening who holds Item/Configure narrows the exposure.

References

Related entries

• GitLab: developer-role user can replace package file content and hide packages from ownersCVE-2026-7514 · GitLab CE/EE (Generic Package Registry authorization)Medium
• Apache Airflow: /assets/events returns asset events for every DAG, ignoring per-DAG access controlCVE-2026-75158 · Apache Airflow core API (/assets/events endpoint)Medium
• HPE OneView: remotely triggerable URL redirect in the management consoleCVE-2026-76720 · HPE OneView (open URL redirect)Medium
• Jenkins core: crafted XML submission lets a read-only user create user objects on the controllerCVE-2026-84646 · Jenkins core (XML deserialization, user objects as nested field values)Medium
• Jenkins core: unescaped map keys let a user inject arbitrary fields into JSON and Python API responsesCVE-2026-84655 · Jenkins core (REST API JSON and Python serialization, unescaped map keys)Medium
• Jenkins core: missing permission check exposes build parameters of jobs a user cannot otherwise seeCVE-2026-84656 · Jenkins core (build parameter access, missing Item/Read permission check)Medium