Description
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Pipeline: Groovy Plugin | unspecified – ≤ 2648.va9433432b33c | 2.94.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.21.5-3.rhaos4.8.gitaf64931.el7 | RHSA-2022:0871 |
| Red Hat OpenShift 4 | haproxy +1 | 2.0.16-3.el7 | RHSA-2022:1620, RHSA-2022:1021 |
| Red Hat OpenShift 4 | haproxy22 | 2.2.15-4.el8 | RHSA-2022:1021 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.6.1650364520-1.el8 | RHSA-2022:1620, RHSA-2022:1248, RHSA-2022:1025 |
| Red Hat OpenShift 3 | jenkins | 2.319.3.1650348949-1.el7 | RHSA-2022:1420 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1650371376-1.el7 | RHSA-2022:1420 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
shoucheng3/jenkinsci__workflow-cps-plugin_CVE-2022-25173_2646-v6ed3b5b01ff1 ★ 0 · Aug 17, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps | >= 2646.v6ed3b5b01ff1, < 2656.vf7a | 2656.vf7a | GHSA-4m7p-55jm-3vwv |
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps | >= 2.93, < 2.94.1 | 2.94.1 | GHSA-4m7p-55jm-3vwv |
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps | < 2.92.1 | 2.92.1 | GHSA-4m7p-55jm-3vwv |
Advisories 6
- RHSA-2022:1420 Red Hat Security Advisory: OpenShift Container Platform 3.11.685 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2022:1021 Red Hat Security Advisory: OpenShift Container Platform 4.9.26 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1620 Red Hat Security Advisory: OpenShift Container Platform 4.6.57 packages and security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:0871 Red Hat Security Advisory: OpenShift Container Platform 4.8.35 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1025 Red Hat Security Advisory: OpenShift Container Platform 4.10.6 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1248 Red Hat Security Advisory: OpenShift Container Platform 4.7.48 packages and security update Red Hat Security Advisories (RHSA) · Mar 21, 2026