The Jenkins External Workspace Manager Plugin contains a path traversal flaw in the exwsAllocate Pipeline step. Attackers who possess Item/Configure permissions can supply custom workspace paths that include traversal sequences. The plugin does not reject these sequences, enabling the reading of arbitrary files on the Jenkins controller. In the worst case, this can lead to remote code execution by exposing sensitive configuration or executable binaries.

All releases of the Jenkins External Workspace Manager Plugin up to and including version 1.3.2 are affected. The vulnerability is present in the plugin and affects pipelines that invoke the exwsAllocate step for users with Item/Configure permissions.

The flaw allows a local attacker with sufficient permissions to read arbitrary files on the Jenkins controller. The EPSS score is not available, and the vulnerability is not listed in KEV, indicating that widespread exploitation has not yet been observed. Based on the description, it is inferred that the potential for remote code execution, coupled with the plugin's widespread use, suggests a likely high risk. Crafting the malicious workspace path is straightforward, and no additional exploitation conditions are required beyond the listed permission level. Consequently, the vulnerability warrants urgent attention.