Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Published: 2026-08-10
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Jenkins FilePath.untarFrom() method fails to validate symlink targets when extracting TAR archives, which allows an attacker possessing Item/Configure permission to create symlinks that point to arbitrary files on the controller. The flaw also bypasses the blank-name validation introduced in a prior fix, enabling extraction of files with names that include a Unicode zero‑width character. This combination permits reading of any file within the Jenkins home directory, including configuration files, credentials, and other sensitive data.

Affected Systems

All Jenkins releases are vulnerable to this issue, even those that have applied the security patches for CVE‑2026‑33001 and CVE‑2026‑70427. The specific exception noted is Jenkins 2.576, where a Unicode zero‑width character bypass remains in effect. Until a version that incorporates the fix for CVE‑2026‑19429 is released, no builds of Jenkins can be considered safe from exploitation of this flaw.

Risk and Exploitability

The CVSS score of 9.4 indicates a very high severity impact. The EPSS score of < 1% suggests that active exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires an authenticated user with Item/Configure rights, the risk escalates proportionally to how many users hold that permission. A successful exploit would allow the adversary to read any file in the Jenkins home directory, potentially exposing configuration secrets, environment variables, or other data that could compromise the entire Jenkins setup.

Generated by OpenCVE AI on August 13, 2026 at 09:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a Jenkins version that includes the fix for CVE‑2026‑19429 once available from the vendor.
  • Restrict the Item/Configure permission to only trusted users, or remove it from users who do not need to modify job configuration.
  • Configure the Jenkins process to run with the minimal file system permissions necessary for job execution, ensuring it cannot read sensitive files whose location is outside the intended workspace.

Generated by OpenCVE AI on August 13, 2026 at 09:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Title Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass and Blank-Name Check Bypass (Arbitrary File Read) jenkins: Jenkins: Arbitrary file read via symlink target validation bypass
Weaknesses CWE-184
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 13 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() does not validate symlink targets when extracting TAR archives, allowing an attacker with Item/Configure permission to create symlinks from a workspace to arbitrary files on the Jenkins controller. This issue remains exploitable in versions patched for CVE-2026-33001 and CVE-2026-70427. An attacker can use this to read sensitive files from $JENKINS_HOME, including Jenkins cryptographic keys and stored credentials. Jenkins 2.576 is additionally affected by a Unicode zero-width character bypass of the blank-name validation introduced by CVE-2026-70427. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

 cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Thu, 13 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() does not validate symlink targets in extracted TAR archives, even in versions patched for CVE-2026-33001 and CVE-2026-70427. An authenticated attacker with job configuration privileges can include a malicious archive in a build step that creates workspace symlinks pointing to arbitrary files on the Jenkins controller. By reading the secrets directory, the attacker obtains the cryptographic keys used to sign remember-me cookies, forges a valid administrator session cookie without any admin interaction, and gains access to the Script Console for remote code execution. Jenkins 2.576 is additionally affected by a bypass of the CVE-2026-70427 blank-name check via Unicode zero-width characters (U+200B, U+200C, U+200D, U+2060, U+00AD), which Java's String.isBlank() does not recognize as whitespace. Jenkins FilePath.untarFrom() does not validate symlink targets when extracting TAR archives, allowing an attacker with Item/Configure permission to create symlinks from a workspace to arbitrary files on the Jenkins controller. This issue remains exploitable in versions patched for CVE-2026-33001 and CVE-2026-70427. An attacker can use this to read sensitive files from $JENKINS_HOME, including Jenkins cryptographic keys and stored credentials. Jenkins 2.576 is additionally affected by a Unicode zero-width character bypass of the blank-name validation introduced by CVE-2026-70427.

Tue, 11 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 and CVE-2026-70427 patches applied, contains two distinct symlink validation weaknesses that independently allow arbitrary file read. 1. SYMLINK TARGET NOT VALIDATED (all versions): The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never validated and may point to any path on the controller filesystem. 2. BLANK-NAME CHECK BYPASS via Unicode (Jenkins 2.576): The CVE-2026-70427 patch added a blank-name check using Java's String.isBlank() to reject symlinks with empty names. However, String.isBlank() does not recognize Unicode zero-width characters (U+200B ZERO WIDTH SPACE, U+200C ZERO WIDTH NON-JOINER, U+200D ZERO WIDTH JOINER, U+2060 WORD JOINER, U+00AD SOFT HYPHEN) as whitespace. A tar entry named with any of these characters passes the blank-name check and results in a symlink with an invisible name pointing to an arbitrary target. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory — including master.key, hudson.util.Secret, and credentials.xml — an attacker can exfiltrate all Jenkins cryptographic material and offline-decrypt all {AQA...}-format credential entries, exposing every password, API key, cloud provider secret, and SSH private key stored in Jenkins. Jenkins FilePath.untarFrom() does not validate symlink targets in extracted TAR archives, even in versions patched for CVE-2026-33001 and CVE-2026-70427. An authenticated attacker with job configuration privileges can include a malicious archive in a build step that creates workspace symlinks pointing to arbitrary files on the Jenkins controller. By reading the secrets directory, the attacker obtains the cryptographic keys used to sign remember-me cookies, forges a valid administrator session cookie without any admin interaction, and gains access to the Script Console for remote code execution. Jenkins 2.576 is additionally affected by a bypass of the CVE-2026-70427 blank-name check via Unicode zero-width characters (U+200B, U+200C, U+200D, U+2060, U+00AD), which Java's String.isBlank() does not recognize as whitespace.
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Tue, 11 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never validated and may point to any path on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory — including master.key, hudson.util.Secret, hudson.model.Secrets.xml, and any other files present — an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (GET /job/{name}/ws/) or build artifacts. Combined with credentials.xml and per-user config.xml files, this enables offline AES-128 decryption of all {AQA...}-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store — compromising all downstream systems those credentials protect. Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 and CVE-2026-70427 patches applied, contains two distinct symlink validation weaknesses that independently allow arbitrary file read. 1. SYMLINK TARGET NOT VALIDATED (all versions): The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never validated and may point to any path on the controller filesystem. 2. BLANK-NAME CHECK BYPASS via Unicode (Jenkins 2.576): The CVE-2026-70427 patch added a blank-name check using Java's String.isBlank() to reject symlinks with empty names. However, String.isBlank() does not recognize Unicode zero-width characters (U+200B ZERO WIDTH SPACE, U+200C ZERO WIDTH NON-JOINER, U+200D ZERO WIDTH JOINER, U+2060 WORD JOINER, U+00AD SOFT HYPHEN) as whitespace. A tar entry named with any of these characters passes the blank-name check and results in a symlink with an invisible name pointing to an arbitrary target. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory — including master.key, hudson.util.Secret, and credentials.xml — an attacker can exfiltrate all Jenkins cryptographic material and offline-decrypt all {AQA...}-format credential entries, exposing every password, API key, cloud provider secret, and SSH private key stored in Jenkins.
Title Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass (Arbitrary File Read) Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass and Blank-Name Check Bypass (Arbitrary File Read)
Weaknesses CWE-184

Mon, 10 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never validated and may point to any location on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace pointing to arbitrary controller paths such as $JENKINS_HOME/secrets/master.key, secrets/hudson.util.Secret, or credentials.xml. The attacker then reads the symlinked files through the Jenkins workspace viewer (GET /job/{name}/ws/) or by archiving them as build artifacts, requiring no additional privileges beyond Item/Configure and Item/Workspace. Obtaining master.key and hudson.util.Secret enables offline AES-128 decryption of all {AQA...}-format credential entries in credentials.xml, exposing stored passwords, API keys, and SSH private keys in plaintext. Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never validated and may point to any path on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory — including master.key, hudson.util.Secret, hudson.model.Secrets.xml, and any other files present — an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (GET /job/{name}/ws/) or build artifacts. Combined with credentials.xml and per-user config.xml files, this enables offline AES-128 decryption of all {AQA...}-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store — compromising all downstream systems those credentials protect.
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 8.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Mon, 10 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not symlink targets. The CVE-2026-33001 fix checks that the symlink file (destination) is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never sanitized. An attacker with Item/Configure permission can supply a malicious .tar or .tar.gz archive (for example via a tool installer or custom archive extraction step) that, when extracted by FilePath.untarFrom(), creates persistent symlinks on the controller filesystem pointing to arbitrary paths such as secrets/master.key, secrets/hudson.util.Secret, and credentials.xml. Reading these files through the created symlinks enables offline AES-128 decryption of all credentials stored in the Jenkins credential store, leading to full credential compromise. Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never validated and may point to any location on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace pointing to arbitrary controller paths such as $JENKINS_HOME/secrets/master.key, secrets/hudson.util.Secret, or credentials.xml. The attacker then reads the symlinked files through the Jenkins workspace viewer (GET /job/{name}/ws/) or by archiving them as build artifacts, requiring no additional privileges beyond Item/Configure and Item/Workspace. Obtaining master.key and hudson.util.Secret enables offline AES-128 decryption of all {AQA...}-format credential entries in credentials.xml, exposing stored passwords, API keys, and SSH private keys in plaintext.
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Mon, 10 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers tar extraction via POST /job/{name}/build, writing persistent symlinks into the tool cache. Symlinks to secrets/master.key, hudson.util.Secret, credentials.xml, and users/*/config.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all credentials and admin API tokens without bcrypt cracking, achieving RCE. Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not symlink targets. The CVE-2026-33001 fix checks that the symlink file (destination) is created within the workspace boundary, but the symlink target — the path returned by te.getLinkName() and passed directly to symlinkTo() — is never sanitized. An attacker with Item/Configure permission can supply a malicious .tar or .tar.gz archive (for example via a tool installer or custom archive extraction step) that, when extracted by FilePath.untarFrom(), creates persistent symlinks on the controller filesystem pointing to arbitrary paths such as secrets/master.key, secrets/hudson.util.Secret, and credentials.xml. Reading these files through the created symlinks enables offline AES-128 decryption of all credentials stored in the Jenkins credential store, leading to full credential compromise.
Title Jenkins Project Jenkins - Symlink Target Validation Bypass Arbitrary File Read Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass (Arbitrary File Read)
References

Mon, 10 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers malicious tar extraction via POST /job/{name}/build, writing persistent symlinks into the Jenkins tool cache. Symlinks to secrets/master.key and credentials.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all stored credentials and admin RCE. Symlinks to /dev/zero or blocking FIFOs hang build executors. Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers tar extraction via POST /job/{name}/build, writing persistent symlinks into the tool cache. Symlinks to secrets/master.key, hudson.util.Secret, credentials.xml, and users/*/config.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all credentials and admin API tokens without bcrypt cracking, achieving RCE.
Metrics cvssV4_0

{'score': 9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Mon, 10 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access can trigger extraction of a malicious tar via POST /job/{name}/build, planting symlinks to secrets/master.key, secrets/hudson.util.Secret, and credentials.xml. Files are read via GET /job/{name}/lastBuild/consoleText. These three files enable offline AES decryption of all stored Jenkins credentials, escalating to admin access and RCE. Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers malicious tar extraction via POST /job/{name}/build, writing persistent symlinks into the Jenkins tool cache. Symlinks to secrets/master.key and credentials.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all stored credentials and admin RCE. Symlinks to /dev/zero or blocking FIFOs hang build executors.
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 10 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing the CVE-2026-33001 fix. An admin points a tool installer (DownloadFromUrlInstaller/ZipExtractionInstaller) at an attacker URL; any user's POST /job/{name}/build then extracts the malicious tar, planting symlinks in the tool cache. Sensitive files are read via GET /job/{name}/lastBuild/consoleText or GET /job/{name}/ws/{file}, exposing /etc/passwd, secrets/master.key, and credentials.xml. Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access can trigger extraction of a malicious tar via POST /job/{name}/build, planting symlinks to secrets/master.key, secrets/hudson.util.Secret, and credentials.xml. Files are read via GET /job/{name}/lastBuild/consoleText. These three files enable offline AES decryption of all stored Jenkins credentials, escalating to admin access and RCE.

Mon, 10 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Description An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files. Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing the CVE-2026-33001 fix. An admin points a tool installer (DownloadFromUrlInstaller/ZipExtractionInstaller) at an attacker URL; any user's POST /job/{name}/build then extracts the malicious tar, planting symlinks in the tool cache. Sensitive files are read via GET /job/{name}/lastBuild/consoleText or GET /job/{name}/ws/{file}, exposing /etc/passwd, secrets/master.key, and credentials.xml.
First Time appeared Jenkins Project
Jenkins Project jenkins
Vendors & Products Jenkins Project
Jenkins Project jenkins

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files.
Title Jenkins Project Jenkins - Symlink Target Validation Bypass Arbitrary File Read
Weaknesses CWE-59
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Jenkins Project Jenkins
cve-icon MITRE

Status: REJECTED

Assigner: TuranSec

Published:

Updated: 2026-08-13T11:43:54.947Z

Reserved: 2026-08-10T12:06:37.123Z

Link: CVE-2026-19429

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-10T13:17:58.940

Modified: 2026-08-13T12:17:23.280

Link: CVE-2026-19429

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:07:02Z

Links: CVE-2026-19429 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T10:00:05Z

Weaknesses
  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')