BIT-jenkins-2026-70427

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/jenkins/BIT-jenkins-2026-70427.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-jenkins-2026-70427

Aliases

CVE-2026-70427

Published

2026-08-17T05:44:38.734Z

Modified

2026-08-17T08:01:33.965144309Z

Summary

[none]

Details

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.

Database specific

{
    "severity": "Medium",
    "cpes": [
        "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:maven:*:*"
    ]
}

References

Affected packages

Bitnami / jenkins

Package

Name: jenkins
Purl: pkg:bitnami/jenkins

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.568.2

Introduced

2.569.0

Fixed

2.576.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/jenkins/BIT-jenkins-2026-70427.json"