An incomplete patch for the earlier CVE-2026-33001 flaw in Jenkins allows a remote attacker who is authenticated and holds Item/Configure permission to read any file on the Jenkins controller that the Jenkins process can access. The flaw occurs during tar extraction in the FilePath.java component: the system validates the symlink’s location within the workspace but fails to validate the symlink’s target. As a result, a symlink created inside the workspace can point to an arbitrary path outside the workspace, enabling disclosure of sensitive files such as secrets/master.key and credentials.xml. The vulnerability is a classic path traversal bypass that compromises confidentiality and may expose credentials or other secrets.

All Jenkins Project Jenkins releases up to and including LTS 2.555.3 are affected, as the incomplete patch was applied only through that version. Later releases that include the complete fix are not impacted.

The CVSS score of 6.5 indicates a moderate severity impact. The EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified, and the issue is not listed in the CISA KEV catalog. Because the attack requires an authenticated user with Item/Configure permission, the threat is limited to individuals who have such privileges within a Jenkins instance. If these permissions are granted to a large number of users, the risk escalates accordingly, but the overall exposure remains confined to the Jenkins controller’s filesystem.