Database/Control plane, storage & DevOps
Jenkins Robot Framework Plugin: archive path escapes the build directory, allowing arbitrary file write
Impact
The plugin does not verify that the configured Robot Framework report archive directory stays inside the build directory, so a user with Item/Configure permission can create or overwrite arbitrary files on the Jenkins controller filesystem with content they choose. Writing into the controller's own config, plugin or init.groovy.d paths turns that into code execution on the controller, and the controller holds the cluster credentials and signing material used to deploy onto the GPU fleet. Item/Configure is routinely granted to teams that own their own jobs, so the attacker population here is larger than the admin set.
Who can reach it
An authenticated Jenkins user holding Item/Configure permission on any job. No controller admin rights needed.
What to do
Upgrade the Robot Framework Plugin past 6.2.2 to the release named in the 2026-09-16 Jenkins advisory; the upgrade requires a Jenkins controller restart. If you cannot upgrade immediately, review who holds Item/Configure and restrict it, and check the controller filesystem for unexpected files under the Jenkins home directory.
References
Related entries
- KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes APINCVD-2026-051-kubeedge-configupdatejob-handler · KubeEdge (ConfigUpdateJob handler, updateFields)High
- KubeEdge (NodeUpgradeJob handler, v1alpha2 API): REMOTE CODE EXECUTION ON EDGE NODES through the upgrade path. TheNCVD-2026-052-kubeedge-nodeupgradejob-handler · KubeEdge (NodeUpgradeJob handler, v1alpha2 API)High
- APC Network Management Card 4 (NMC4): An unauthenticated attacker can manipulate URL parameters to walk out of the webCVE-2024-58310 · APC Network Management Card 4 (NMC4)High
- Cisco Nexus Dashboard Fabric Controller (SSH host key validation): NDFC does not validate the SSH host keysCVE-2025-20163 · Cisco Nexus Dashboard Fabric Controller (SSH host key validation)High
- MinIO (S3 API, unsigned-trailer uploads): Signature validation on unsigned-trailer uploads is incomplete, so knowingCVE-2025-31489 · MinIO (S3 API, unsigned-trailer uploads)High
- HPE OneView for VMware vCenter (vertical privilege escalation): A read-only user performs administrative actionsCVE-2025-37101 · HPE OneView for VMware vCenter (vertical privilege escalation)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.