Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T17:40:28 jenkins: Jenkins: Arbitrary file write via path traversal 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-22

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.

OpenShift Developer Tools and Services Affected jenkins https://www.cve.org/CVERecord?id=CVE-2026-70428 https://nvd.nist.gov/vuln/detail/CVE-2026-70428 https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927