The vulnerability arises from Jenkins failing to safely resolve symbolic links when extracting tar and tar.gz archives. A beneficiary attacker can craft an archive that, when uploaded and extracted, overwrites arbitrary files on the controller filesystem. This permits the deployment of malicious scripts or plugins, enabling an attacker to execute code with the privileges of the Jenkins process. The flaw is classified as CWE‑22 and CWE‑59 and poses a significant threat to confidentiality, integrity and availability of the system.

The affected products are Jenkins instances powered by the Jenkins Project. Versions up to and including Jenkins 2.554 and the Long Term Support release 2.541.2 (and earlier) are vulnerable. Any instance running these releases in a non‑patched state is at risk.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers need the ability to upload or control the extraction of archives, typically requiring Item/Configure permission or the ability to influence agent processes. Once satisfied, the attacker can write files outside the Jenkins home directory, providing a foothold for code execution.