The vulnerability lies in Jenkins's handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, a flaw that represents a path traversal (CWE‑59). The likely attack vector is an attacker who can control a Jenkins agent, supplying a specially crafted archive to the controller. When the archive is extracted, Jenkins writes files to arbitrary locations on the file system, restricted only by the file system permissions of the user running Jenkins. This effect is an arbitrary file write that can be used to create, overwrite or delete files that Jenkins can access, potentially leading to code execution, unauthorized data modification or introduction of malicious artifacts.

The flaw affects Jenkins Project Jenkins versions 2.575 and earlier for regular releases and LTS 2.568.1 and earlier. Any installation of these versions is vulnerable until updated.

There is no EPSS score available and the vulnerability has not been listed in the CISA KEV catalog. The CVSS score of 4.3 indicates a moderate severity. The likely attack vector is that an attacker who can control a Jenkins agent supplies a crafted tar archive to the controller; once an agent can be manipulated, the exploit is straightforward because Jenkins does not sanitize the symbolic link names during extraction. The risk is moderate in environments where Jenkins runs with elevated privileges or where agent uploads are not tightly restricted, given the CVSS score, and could allow modification of configuration files or placement of executable artifacts.