Jenkins: path traversal in file parameter names writes arbitrary files on the controller filesystem

Impact

File parameter names are checked improperly for traversal, so a user who can configure and run a job can make an uploaded file land outside the workspace, anywhere the Jenkins user has write access. This is a privilege boundary failure between job owners and the controller administrator: in a multi-team GPU shop where each team configures its own training and image-build pipelines but nobody is supposed to own the controller, any of those team members can drop files into controller-owned paths. The controller typically holds registry credentials and cluster kubeconfigs, so file write there is worth treating as a route toward controller compromise. Jenkins scores it 4.3, integrity only; the advisory does not claim code execution.

Who can reach it

Authenticated Jenkins user holding Item/Configure and Item/Build on any job. No agent access and no administrator rights required.

What to do

Upgrade to a Jenkins weekly release after 2.575 or LTS after 2.568.1 per SECURITY-3927 in the 2026-08-05 advisory - the same upgrade that covers SECURITY-3930. Cost is a controller restart: the queue pauses, agents reconnect, running builds are lost unless drained. In the meantime, tightening who holds Item/Configure narrows the exposure.

References

Related entries

• GitLab CE/EE: developer-role user can modify package registry metadata without maintainer rightsCVE-2026-8667 · GitLab CE/EE (package registry metadata authorization)Medium
• Infineon cryptographic library (ECDSA) in security microcontrollers: Electromagnetic side channel in Infineon's ECDSACVE-2024-45678 · Infineon cryptographic library (ECDSA) in security microcontrollersMedium
• Slurm (slurmdbd accounting, Coordinator role): A Coordinator - the delegated role a site gives a team lead over theirCVE-2025-43904 · Slurm (slurmdbd accounting, Coordinator role)Medium
• HTCondor (condor_schedd / Access Point): A user plants a specially crafted job that lies dormant, then runs as aCVE-2025-66433 · HTCondor (condor_schedd / Access Point)Medium
• AMD IOMMU register interface - ASP coherency: Improper access control on the IOMMU register interface lets a privilegedCVE-2025-54509 · AMD IOMMU register interface - ASP coherencyMedium
• AGESA Boot Loader (ABL) - SPI ROM header input validation (AMD-SB-3003): The AGESA Boot Loader does not properlyCVE-2021-46772 · AGESA Boot Loader (ABL) - SPI ROM header input validation (AMD-SB-3003)Low