Medium · 4.3 CVE-2026-70427 EUVD-2026-53570GHSA-xvrr-fjq7-cfrw

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction…

Published Aug 5, 2026 · Updated Aug 5, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Category: Web / CMS

Description

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins	—	—

Advisories 1

WID-SEC-2026-2665 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026

References

Jenkins Security Advisory 2026-08-05 vendor-advisory