Description
A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.185 and earlier, LTS 2.176.1 and earlier | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.176.2.1563461785-1.el7 | RHSA-2019:2548 |
| Red Hat OpenShift 3 | jenkins | 2.176.2.1563460897-1.el7 | RHSA-2019:2503 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.176.2 | 2.176.2 | GHSA-qr42-82qj-mw65 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.177, < 2.186 | 2.186 | GHSA-qr42-82qj-mw65 |
Advisories 2
- RHSA-2019:2548 Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2019:2503 Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://www.tenable.com/security/research/tra-2019-35
- [oss-security] 20190717 Multiple vulnerabilities in Jenkins mailing-list
- 109299 vdb-entry
- RHSA-2019:2503 vendor-advisory
- RHSA-2019:2548 vendor-advisory
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-1424